diff --git a/bin/doc_gen.py b/bin/doc_gen.py index e19570eba1..5bcde92874 100644 --- a/bin/doc_gen.py +++ b/bin/doc_gen.py @@ -7,6 +7,9 @@ from os import path, walk import json from jinja2 import Environment, FileSystemLoader from pyattck import Attck +import datetime + + def mitre_attack_object(technique, attack): @@ -148,7 +151,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de # write markdown template = j2_env.get_template('doc_stories_markdown.j2') output_path = path.join(OUTPUT_DIR + '/stories.md') - output = template.render(categories=categories) + output = template.render(categories=categories,time=datetime.datetime.now()) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) messages.append("doc_gen.py wrote {0} stories documentation in markdown to: {1}".format(len(stories),output_path)) @@ -156,7 +159,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de # write wikimarkup template = j2_env.get_template('doc_stories_wiki.j2') output_path = path.join(OUTPUT_DIR + '/stories.wiki') - output = template.render(categories=categories) + output = template.render(categories=categories, time=datetime.datetime.now()) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) messages.append("doc_gen.py wrote {0} stories documentation in mediawiki to: {1}".format(len(stories),output_path)) @@ -206,7 +209,7 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag # write markdown template = j2_env.get_template('doc_detections_markdown.j2') output_path = path.join(OUTPUT_DIR + '/detections.md') - output = template.render(detections=sorted_detections) + output = template.render(detections=sorted_detections, time=datetime.datetime.now()) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) messages.append("doc_gen.py wrote {0} detections documentation in markdown to: {1}".format(len(detections),output_path)) @@ -231,7 +234,7 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag # write wikimarkup template = j2_env.get_template('doc_detections_wiki.j2') output_path = path.join(OUTPUT_DIR + '/detections.wiki') - output = template.render(kinds=kinds) + output = template.render(kinds=kinds, time=datetime.datetime.now()) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path)) diff --git a/bin/jinja2_templates/doc_detections_wiki.j2 b/bin/jinja2_templates/doc_detections_wiki.j2 index 7b5ece8ad2..e69a4a14b4 100644 --- a/bin/jinja2_templates/doc_detections_wiki.j2 +++ b/bin/jinja2_templates/doc_detections_wiki.j2 @@ -82,4 +82,3 @@ All the detections shipped to different Splunk products. Below is a breakdown by ''# Contact: research@splunk.com'' ''#############'' -[[Category:V:ESSOC:drafts]] diff --git a/bin/jinja2_templates/doc_stories_wiki.j2 b/bin/jinja2_templates/doc_stories_wiki.j2 index 67024eb080..d187f7d672 100644 --- a/bin/jinja2_templates/doc_stories_wiki.j2 +++ b/bin/jinja2_templates/doc_stories_wiki.j2 @@ -56,11 +56,12 @@ All the Analytic Stories shipped to different Splunk products. Below is a breakd {% endfor %} -''#############'' -''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -''# On Date: {{ time }} UTC'' -''# Author: Splunk Security Research'' -''# Contact: research@splunk.com'' -''#############'' +'' +############# +# Automatically generated by doc_gen.py in https://github.com/splunk/security_content +# On Date: {{ time }} UTC +# Author: Splunk Security Research +# Contact: research@splunk.com +############# +'' -[[Category:V:ESSOC:drafts]] diff --git a/docs/detections.wiki b/docs/detections.wiki index b1cdfa73be..0a13366eb2 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -11,7 +11,7 @@ The search queries the authentication logs for assets that are categorized as ro * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-12
@@ -20,11 +20,11 @@ The search queries the authentication logs for assets that are categorized as ro ====Search==== | tstats `security_content_summariesonly` count earliest(_time) as earliest latest(_time) as latest from datamodel=Authentication where Authentication.dest_category=router by Authentication.dest Authentication.user -| eval isOutlier=if(earliest >= relative_time(now(), "-30d@d"), 1, 0) +| eval isOutlier=if(earliest >= relative_time(now(), "-30d@d"), 1, 0) | where isOutlier=1 | `security_content_ctime(earliest)` -| `security_content_ctime(latest)` -| `drop_dm_object_name("Authentication")` +| `security_content_ctime(latest)` +| `drop_dm_object_name("Authentication")` | `detect_new_login_attempts_to_routers_filter` ====Associated Analytic Story==== @@ -65,7 +65,7 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Email -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-19
@@ -73,13 +73,13 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio ====Search==== -| tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Email")` -| eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name) -| search space_ratio >= 0.1 -| rex field=recipient_address "(?.*)@" +| tstats `security_content_summariesonly` count values(All_Email.recipient) as recipient_address min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Email")` +| eval space_ratio = (mvcount(split(file_name," "))-1)/len(file_name) +| search space_ratio >= 0.1 +| rex field=recipient_address "(?.*)@" | `email_attachments_with_lots_of_spaces_filter` ====Associated Analytic Story==== @@ -132,9 +132,9 @@ The search looks at the change-analysis data model and detects email files creat ====Search==== -| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path != "C:\\Users\\*\\My Documents\\Outlook Files\\*" Filesystem.file_path!="C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest -| `drop_dm_object_name("Filesystem")` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name=*.pst OR Filesystem.file_name=*.ost) Filesystem.file_path != "C:\\Users\\*\\My Documents\\Outlook Files\\*" Filesystem.file_path!="C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*" by Filesystem.action Filesystem.process_id Filesystem.file_name Filesystem.dest +| `drop_dm_object_name("Filesystem")` +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `email_files_written_outside_of_the_outlook_directory_filter` @@ -195,14 +195,14 @@ This search looks for an increase of data transfers from your email server to yo ====Search==== -| tstats `security_content_summariesonly` sum(All_Traffic.bytes_out) as bytes_out from datamodel=Network_Traffic where All_Traffic.src_category=email_server by All_Traffic.dest_ip _time span=1d -| `drop_dm_object_name("All_Traffic")` -| eventstats avg(bytes_out) as avg_bytes_out stdev(bytes_out) as stdev_bytes_out -| eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_avg_bytes_out stdev(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_stdev_bytes_out by dest_ip -| eval minimum_data_samples = 4, deviation_threshold = 3 -| where num_data_samples >= minimum_data_samples AND bytes_out > (avg_bytes_out + (deviation_threshold * stdev_bytes_out)) AND bytes_out > (per_source_avg_bytes_out + (deviation_threshold * per_source_stdev_bytes_out)) AND _time >= relative_time(now(), "@d") -| eval num_standard_deviations_away_from_server_average = round(abs(bytes_out - avg_bytes_out) / stdev_bytes_out, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_out - per_source_avg_bytes_out) / per_source_stdev_bytes_out, 2) -| table dest_ip, _time, bytes_out, avg_bytes_out, per_source_avg_bytes_out, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average +| tstats `security_content_summariesonly` sum(All_Traffic.bytes_out) as bytes_out from datamodel=Network_Traffic where All_Traffic.src_category=email_server by All_Traffic.dest_ip _time span=1d +| `drop_dm_object_name("All_Traffic")` +| eventstats avg(bytes_out) as avg_bytes_out stdev(bytes_out) as stdev_bytes_out +| eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_avg_bytes_out stdev(eval(if(_time < relative_time(now(), "@d"), bytes_out, null))) as per_source_stdev_bytes_out by dest_ip +| eval minimum_data_samples = 4, deviation_threshold = 3 +| where num_data_samples >= minimum_data_samples AND bytes_out > (avg_bytes_out + (deviation_threshold * stdev_bytes_out)) AND bytes_out > (per_source_avg_bytes_out + (deviation_threshold * per_source_stdev_bytes_out)) AND _time >= relative_time(now(), "@d") +| eval num_standard_deviations_away_from_server_average = round(abs(bytes_out - avg_bytes_out) / stdev_bytes_out, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_out - per_source_avg_bytes_out) / per_source_stdev_bytes_out, 2) +| table dest_ip, _time, bytes_out, avg_bytes_out, per_source_avg_bytes_out, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average | `email_servers_sending_high_volume_traffic_to_hosts_filter` ====Associated Analytic Story==== @@ -254,7 +254,7 @@ This search looks for emails claiming to be sent from a domain similar to one th * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Email -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2018-01-05
@@ -262,15 +262,15 @@ This search looks for emails claiming to be sent from a domain similar to one th ====Search==== -| tstats `security_content_summariesonly` values(All_Email.recipient) as recipients, min(_time) as firstTime, max(_time) as lastTime from datamodel=Email by All_Email.src_user, All_Email.message_id -| `drop_dm_object_name("All_Email")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| eval temp=split(src_user, "@") -| eval email_domain=mvindex(temp, 1) -| lookup update=true brandMonitoring_lookup domain as email_domain OUTPUT domain_abuse -| search domain_abuse=true -| table message_id, src_user, email_domain, recipients, firstTime, lastTime +| tstats `security_content_summariesonly` values(All_Email.recipient) as recipients, min(_time) as firstTime, max(_time) as lastTime from datamodel=Email by All_Email.src_user, All_Email.message_id +| `drop_dm_object_name("All_Email")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| eval temp=split(src_user, "@") +| eval email_domain=mvindex(temp, 1) +| lookup update=true brandMonitoring_lookup domain as email_domain OUTPUT domain_abuse +| search domain_abuse=true +| table message_id, src_user, email_domain, recipients, firstTime, lastTime | `monitor_email_for_brand_abuse_filter` ====Associated Analytic Story==== @@ -312,7 +312,7 @@ None at this time This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.001/ T1078.001] * '''Last Updated''': 2020-07-21 @@ -320,11 +320,11 @@ This search detects Okta login failures due to bad credentials for multiple user
====Search==== -`okta` outcome.reason=INVALID_CREDENTIALS -| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city -| stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`okta` outcome.reason=INVALID_CREDENTIALS +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| stats min(_time) as firstTime max(_time) as lastTime dc(user) as distinct_users values(user) as users by src_ip, displayMessage, outcome.reason, country, state, city +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | search distinct_users > 5 | `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` @@ -375,7 +375,7 @@ This search looks for Windows endpoints that have not generated an event indicat * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Updates -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-15
@@ -383,15 +383,15 @@ This search looks for Windows endpoints that have not generated an event indicat ====Search==== -| tstats `security_content_summariesonly` max(_time) as lastTime from datamodel=Updates where Updates.status=Installed Updates.vendor_product="Microsoft Windows" by Updates.dest Updates.status Updates.vendor_product -| rename Updates.dest as Host -| rename Updates.status as "Update Status" -| rename Updates.vendor_product as Product -| eval isOutlier=if(lastTime <= relative_time(now(), "-60d@d"), 1, 0) -| `security_content_ctime(lastTime)` -| search isOutlier=1 -| rename lastTime as "Last Update Time", -| table Host, "Update Status", Product, "Last Update Time" +| tstats `security_content_summariesonly` max(_time) as lastTime from datamodel=Updates where Updates.status=Installed Updates.vendor_product="Microsoft Windows" by Updates.dest Updates.status Updates.vendor_product +| rename Updates.dest as Host +| rename Updates.status as "Update Status" +| rename Updates.vendor_product as Product +| eval isOutlier=if(lastTime <= relative_time(now(), "-60d@d"), 1, 0) +| `security_content_ctime(lastTime)` +| search isOutlier=1 +| rename lastTime as "Last Update Time", +| table Host, "Update Status", Product, "Last Update Time" | `no_windows_updates_in_a_time_frame_filter` ====Associated Analytic Story==== @@ -429,7 +429,7 @@ None identified Detect Okta user lockout events * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.001/ T1078.001] * '''Last Updated''': 2020-07-21 @@ -437,9 +437,9 @@ Detect Okta user lockout events
====Search==== -`okta` displayMessage="Max sign in attempts exceeded" -| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city -| table _time, user, country, state, city, src_ip +`okta` displayMessage="Max sign in attempts exceeded" +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` ====Associated Analytic Story==== @@ -488,7 +488,7 @@ None. Account lockouts should be followed up on to determine if the actual user Detect failed Okta SSO events * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.001/ T1078.001] * '''Last Updated''': 2020-07-21 @@ -496,10 +496,10 @@ Detect failed Okta SSO events
====Search==== -`okta` displayMessage="User attempted unauthorized access to app" -| stats min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`okta` displayMessage="User attempted unauthorized access to app" +| stats min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `okta_failed_sso_attempts_filter` ====Associated Analytic Story==== @@ -548,7 +548,7 @@ There may be a faulty config preventing legitmate users from accessing apps they This search detects logins from the same user from different cities in a 24 hour period. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.001/ T1078.001] * '''Last Updated''': 2020-07-21 @@ -556,11 +556,11 @@ This search detects logins from the same user from different cities in a 24 hour
====Search==== -`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null -| stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user +`okta` displayMessage="User login to Okta" client.geographicalContext.city!=null +| stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `okta_user_logins_from_multiple_cities_filter` +| `security_content_ctime(lastTime)` +| `okta_user_logins_from_multiple_cities_filter` | search locations > 1 ====Associated Analytic Story==== @@ -609,7 +609,7 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe Malicious mails can conduct phishing that induces readers to open attachment, click links or trigger third party service. This detect uses Natural Language Processing (NLP) approach to analyze an email message's content (Sender, Subject and Body) and judge whether it is a phishing email. The detection adopts a deep learning (neural network) model that employs character level embeddings plus LSTM layers to perform classification. The model is pre-trained and then published as ONNX format. Current sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json User are expected to re-train the model by combining with their own training data for better accuracy using the provided model file (SMLE notebook). DSP pipeline then processes the email message and passes it as an event to Apply ML Models function, which returns the probability of a phishing email. Current implementation assumes the email is fed to DSP in JSON format contains at least email's sender, subject and its message body, including reply content, if any. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1566/ T1566] * '''Last Updated''': 2020-08-25 @@ -618,16 +618,16 @@ Malicious mails can conduct phishing that induces readers to open attachment, cl ====Search==== -| from read_ssa_enriched_events() -| eval eventLine=concat(ucast(map_get(input_event, "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), _time=map_get(input_event, "_time") -| where eventLine IS NOT NULL +| from read_ssa_enriched_events() +| eval eventLine=concat(ucast(map_get(input_event, "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", " "), " ", ucast(map_get(input_event, "Content"), "string", " "), " "), _time=map_get(input_event, "_time") +| where eventLine IS NOT NULL | eval mapC={" ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40, ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49, "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58, ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67, "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76, "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85, "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94, "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g": 103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o": 111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w": 119, "x": 120, "y": 121, "z": 122, "{": 123, " -|": 124, "}": 125, "~": 126}, ml_in = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") ) -| apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" path="s3://smle-experiments/models/phishing_email" -| eval probability = mvindex(ml_out, 0) -| where probability > 0.5 -| eval start_time=_time, end_time=_time, entities="TBD", body="TBD" -| select probability, body, entities, start_time, end_time +|": 124, "}": 125, "~": 126}, ml_in = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") ) +| apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8" path="s3://smle-experiments/models/phishing_email" +| eval probability = mvindex(ml_out, 0) +| where probability > 0.5 +| eval start_time=_time, end_time=_time, entities="TBD", body="TBD" +| select probability, body, entities, start_time, end_time | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -677,7 +677,7 @@ The search is used to detect systems that are still vulnerable to the Spectre an * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Vulnerabilities -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-01-07
@@ -685,10 +685,10 @@ The search is used to detect systems that are still vulnerable to the Spectre an ====Search==== -| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Vulnerabilities where Vulnerabilities.cve ="CVE-2017-5753" OR Vulnerabilities.cve ="CVE-2017-5715" OR Vulnerabilities.cve ="CVE-2017-5754" by Vulnerabilities.dest -| `drop_dm_object_name(Vulnerabilities)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Vulnerabilities where Vulnerabilities.cve ="CVE-2017-5753" OR Vulnerabilities.cve ="CVE-2017-5715" OR Vulnerabilities.cve ="CVE-2017-5754" by Vulnerabilities.dest +| `drop_dm_object_name(Vulnerabilities)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `spectre_and_meltdown_vulnerable_systems_filter` ====Associated Analytic Story==== @@ -735,11 +735,11 @@ This detection looks for emails that are suspicious because of their sender, dom ====Search==== -|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_UEBA_Events.category) as category from datamodel=UEBA where nodename=All_UEBA_Events.UEBA_Anomalies All_UEBA_Events.UEBA_Anomalies.uba_model = "SuspiciousEmailDetectionModel" by All_UEBA_Events.description All_UEBA_Events.severity All_UEBA_Events.user All_UEBA_Events.uba_event_type All_UEBA_Events.link All_UEBA_Events.signature All_UEBA_Events.url All_UEBA_Events.UEBA_Anomalies.uba_model -| `drop_dm_object_name(All_UEBA_Events)` +|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_UEBA_Events.category) as category from datamodel=UEBA where nodename=All_UEBA_Events.UEBA_Anomalies All_UEBA_Events.UEBA_Anomalies.uba_model = "SuspiciousEmailDetectionModel" by All_UEBA_Events.description All_UEBA_Events.severity All_UEBA_Events.user All_UEBA_Events.uba_event_type All_UEBA_Events.link All_UEBA_Events.signature All_UEBA_Events.url All_UEBA_Events.UEBA_Anomalies.uba_model +| `drop_dm_object_name(All_UEBA_Events)` | `drop_dm_object_name(UEBA_Anomalies)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `suspicious_email___uba_anomaly_filter` ====Associated Analytic Story==== @@ -799,11 +799,11 @@ This search looks for emails that have attachments with suspicious file extensio ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Email")` -| `suspicious_email_attachments` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Email where All_Email.file_name="*" by All_Email.src_user, All_Email.file_name All_Email.message_id +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Email")` +| `suspicious_email_attachments` | `suspicious_email_attachment_extensions_filter` ====Associated Analytic Story==== @@ -858,21 +858,21 @@ None identified This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-12-06
====Search==== -`stream_http` http_method=POST http_content_length>1 +`stream_http` http_method=POST http_content_length>1 | regex form_data="(?i)java\.lang\.(?:runtime -|processbuilder)" -| rename src_ip as src -| stats count earliest(_time) as firstTime, latest(_time) as lastTime, values(url) as uri, values(status) as status, values(http_user_agent) as http_user_agent by src, dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +|processbuilder)" +| rename src_ip as src +| stats count earliest(_time) as firstTime, latest(_time) as lastTime, values(url) as uri, values(status) as status, values(http_user_agent) as http_user_agent by src, dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_java_classes_filter` ====Associated Analytic Story==== @@ -922,9 +922,9 @@ This search looks for suspicious processes on all systems labeled as web servers ====Search==== | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.dest_category="web_server" AND (Processes.process="*whoami*" OR Processes.process="*ping*" OR Processes.process="*iptables*" OR Processes.process="*wget*" OR Processes.process="*service*" OR Processes.process="*curl*") by Processes.process Processes.process_name, Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `web_servers_executing_suspicious_processes_filter` ====Associated Analytic Story==== @@ -981,7 +981,7 @@ This search looks for AssumeRole events where an IAM role in a different account * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-28
@@ -989,15 +989,15 @@ This search looks for AssumeRole events where an IAM role in a different account ====Search==== -| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role -| `drop_dm_object_name(Authentication)` -| rex field=user_role "arn:aws:sts:*:(?.*):" -| where vendor_account != dest_account -| rename vendor_account as requestingAccountId dest_account as requestedAccountId -| lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime -| eval status = if(firstTime > relative_time(now(), "-24h@h"),"New Cross Account Activity","Previously Seen") -| where status = "New Cross Account Activity" -| `security_content_ctime(firstTime)` +| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role +| `drop_dm_object_name(Authentication)` +| rex field=user_role "arn:aws:sts:*:(?.*):" +| where vendor_account != dest_account +| rename vendor_account as requestingAccountId dest_account as requestedAccountId +| lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime +| eval status = if(firstTime > relative_time(now(), "-24h@h"),"New Cross Account Activity","Previously Seen") +| where status = "New Cross Account Activity" +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_cross_account_activity_from_previously_unseen_account_filter` @@ -1040,7 +1040,7 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator that your account is compromised and the attacker uses the encryption key to compromise another company. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1486/ T1486] * '''Last Updated''': 2021-01-11 @@ -1048,17 +1048,17 @@ This search provides detection of KMS keys which action kms:Encrypt is accessibl
====Search==== -`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy -| spath input=requestParameters.policy output=key_policy_statements path=Statement{} -| mvexpand key_policy_statements -| spath input=key_policy_statements output=key_policy_action_1 path=Action -| spath input=key_policy_statements output=key_policy_action_2 path=Action{} -| eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) -| spath input=key_policy_statements output=key_policy_principal path=Principal.AWS -| search key_policy_action="kms:Encrypt" AND key_policy_principal="*" -| stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId +`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy +| spath input=requestParameters.policy output=key_policy_statements path=Statement{} +| mvexpand key_policy_statements +| spath input=key_policy_statements output=key_policy_action_1 path=Action +| spath input=key_policy_statements output=key_policy_action_2 path=Action{} +| eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) +| spath input=key_policy_statements output=key_policy_principal path=Principal.AWS +| search key_policy_action="kms:Encrypt" AND key_policy_principal="*" +| stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter` ====Associated Analytic Story==== @@ -1115,7 +1115,7 @@ unknown This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1486/ T1486] * '''Last Updated''': 2021-01-11 @@ -1123,11 +1123,11 @@ This search provides detection of users with KMS keys performing encryption spec
====Search==== -`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" -| rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file -| stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user +`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" +| rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file +| stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter` ====Associated Analytic Story==== @@ -1184,17 +1184,17 @@ bucket with S3 encryption This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 -|table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason -|dedup user.username user.groups{} +`aws_cloudwatchlogs_eks` objectRef.resource=secrets OR configmaps sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 +|table sourceIPs{} user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason +|dedup user.username user.groups{} |`aws_eks_kubernetes_cluster_sensitive_object_access_filter` ====Associated Analytic Story==== @@ -1234,7 +1234,7 @@ Sensitive object access is not necessarily malicious but user and object context The search looks for CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007] * '''Last Updated''': 2021-01-11 @@ -1242,14 +1242,14 @@ The search looks for CloudTrail events to detect if any network ACLs were create
====Search==== -`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 -| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 -| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' -| where port_range>1024] -| fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock +`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 +| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 +| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' +| where port_range>1024] +| fillnull +| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter` ====Associated Analytic Story==== @@ -1302,7 +1302,7 @@ It's possible that an admin has created this ACL with all ports open for some le Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the CloudTrail logs to detect users deleting network ACLs. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007] * '''Last Updated''': 2021-01-12 @@ -1310,11 +1310,11 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
====Search==== -`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false -| fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent +`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false +| fillnull +| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter` ====Associated Analytic Story==== @@ -1367,7 +1367,7 @@ It's possible that a user has legitimately deleted a network ACL. This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2021-01-26 @@ -1375,10 +1375,10 @@ This search provides specific SAML access from specific Service Provider, user a
====Search==== -`cloudtrail` eventName=Assumerolewithsaml -| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent +`cloudtrail` eventName=Assumerolewithsaml +| stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` |`aws_saml_access_by_provider_user_and_principal_filter` ====Associated Analytic Story==== @@ -1437,7 +1437,7 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2021-01-26 @@ -1445,10 +1445,10 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA
====Search==== -`cloudtrail` eventName=UpdateSAMLProvider -| stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId +`cloudtrail` eventName=UpdateSAMLProvider +| stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter` ====Associated Analytic Story==== @@ -1516,21 +1516,21 @@ This search will detect a spike in the number of API calls made to your cloud in ====Search==== -| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h -| `drop_dm_object_name("All_Changes")` -| eval HourOfDay=strftime(_time, "%H") -| eval HourOfDay=floor(HourOfDay/4)*4 -| eval DayOfWeek=strftime(_time, "%w") -| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) -| join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] -| where cardinality >=16 -| apply cloud_excessive_api_calls_v1 threshold=0.005 -| rename "IsOutlier(api_calls)" as isOutlier -| where isOutlier=1 -| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) -| where api_calls > expected_upper_threshold -| eval distance_from_threshold = api_calls - expected_upper_threshold -| table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold +| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] +| where cardinality >=16 +| apply cloud_excessive_api_calls_v1 threshold=0.005 +| rename "IsOutlier(api_calls)" as isOutlier +| where isOutlier=1 +| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) +| where api_calls > expected_upper_threshold +| eval distance_from_threshold = api_calls - expected_upper_threshold +| table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter` ====Associated Analytic Story==== @@ -1592,20 +1592,20 @@ This search finds for the number successfully destroyed cloud instances for ever ====Search==== -| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h -| `drop_dm_object_name("All_Changes")` -| eval HourOfDay=strftime(_time, "%H") -| eval HourOfDay=floor(HourOfDay/4)*4 -| eval DayOfWeek=strftime(_time, "%w") -| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) -| join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] -| where cardinality >=16 -| apply cloud_excessive_instances_destroyed_v1 threshold=0.005 -| rename "IsOutlier(instances_destroyed)" as isOutlier -| where isOutlier=1 -| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) -| eval distance_from_threshold = instances_destroyed - expected_upper_threshold -| table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id +| tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] +| where cardinality >=16 +| apply cloud_excessive_instances_destroyed_v1 threshold=0.005 +| rename "IsOutlier(instances_destroyed)" as isOutlier +| where isOutlier=1 +| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) +| eval distance_from_threshold = instances_destroyed - expected_upper_threshold +| table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter` ====Associated Analytic Story==== @@ -1665,20 +1665,20 @@ This search finds for the number successfully created cloud instances for every ====Search==== -| tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h -| `drop_dm_object_name("All_Changes")` -| eval HourOfDay=strftime(_time, "%H") -| eval HourOfDay=floor(HourOfDay/4)*4 -| eval DayOfWeek=strftime(_time, "%w") -| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) -| join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] -| where cardinality >=16 -| apply cloud_excessive_instances_created_v1 threshold=0.005 -| rename "IsOutlier(instances_launched)" as isOutlier -| where isOutlier=1 -| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) -| eval distance_from_threshold = instances_launched - expected_upper_threshold -| table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id +| tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] +| where cardinality >=16 +| apply cloud_excessive_instances_created_v1 threshold=0.005 +| rename "IsOutlier(instances_launched)" as isOutlier +| where isOutlier=1 +| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) +| eval distance_from_threshold = instances_launched - expected_upper_threshold +| table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter` ====Associated Analytic Story==== @@ -1740,21 +1740,21 @@ This search will detect a spike in the number of API calls made to your cloud in ====Search==== -| tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h -| `drop_dm_object_name("All_Changes")` -| eval HourOfDay=strftime(_time, "%H") -| eval HourOfDay=floor(HourOfDay/4)*4 -| eval DayOfWeek=strftime(_time, "%w") -| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) -| join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] -| where cardinality >=16 -| apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 -| rename "IsOutlier(security_group_api_calls)" as isOutlier -| where isOutlier=1 -| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) -| where security_group_api_calls > expected_upper_threshold -| eval distance_from_threshold = security_group_api_calls - expected_upper_threshold -| table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold +| tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] +| where cardinality >=16 +| apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 +| rename "IsOutlier(security_group_api_calls)" as isOutlier +| where isOutlier=1 +| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) +| where security_group_api_calls > expected_upper_threshold +| eval distance_from_threshold = security_group_api_calls - expected_upper_threshold +| table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter` ====Associated Analytic Story==== @@ -1807,7 +1807,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base This search provides detection information on unauthenticated requests against Kubernetes' Pods API * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] * '''Last Updated''': 2020-04-15 @@ -1815,11 +1815,11 @@ This search provides detection information on unauthenticated requests against K
====Search==== -`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" -| rename source as cluster_name sourceIPs{} as src_ip -| stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(responseStatus.code) values(userAgent) values(verb) values(requestURI) by src_ip cluster_name user.username user.groups{} -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" verb=list objectRef.resource=pods requestURI="/api/v1/pods" +| rename source as cluster_name sourceIPs{} as src_ip +| stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(responseStatus.code) values(userAgent) values(verb) values(requestURI) by src_ip cluster_name user.username user.groups{} +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `amazon_eks_kubernetes_pod_scan_detection_filter` ====Associated Analytic Story==== @@ -1870,7 +1870,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] * '''Last Updated''': 2020-04-15 @@ -1878,11 +1878,11 @@ This search provides information of unauthenticated requests via user agent, and
====Search==== -`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!="AWS Security Scanner" -| rename sourceIPs{} as src_ip -| stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI) by src_ip user.username user.groups{} -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +`aws_cloudwatchlogs_eks` "user.username"="system:anonymous" userAgent!="AWS Security Scanner" +| rename sourceIPs{} as src_ip +| stats count min(_time) as firstTime max(_time) as lastTime values(responseStatus.reason) values(source) as cluster_name values(responseStatus.code) values(userAgent) as http_user_agent values(verb) values(requestURI) by src_ip user.username user.groups{} +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` |`amazon_eks_kubernetes_cluster_scan_detection_filter` ====Associated Analytic Story==== @@ -1942,15 +1942,15 @@ This search looks for new commands from each user role. ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object -| `drop_dm_object_name("All_Changes")` -| lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenUserApiCall=min(firstTimeSeen) -| where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") -| table firstTime, user, object, command -|`security_content_ctime(firstTime)` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object +| `drop_dm_object_name("All_Changes")` +| lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenUserApiCall=min(firstTimeSeen) +| where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") +| table firstTime, user, object, command +|`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cloud_api_calls_from_previously_unseen_user_roles_filter` @@ -2011,15 +2011,15 @@ This search looks for cloud compute instances created by users who have not crea ====Search==== -| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region -| `drop_dm_object_name("All_Changes")` -| lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenUser=min(firstTimeSeen) -| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") -| table firstTime, user, dest, count vendor_region -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region +| `drop_dm_object_name("All_Changes")` +| lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenUser=min(firstTimeSeen) +| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") +| table firstTime, user, dest, count vendor_region +| `security_content_ctime(firstTime)` | `cloud_compute_instance_created_by_previously_unseen_user_filter` ====Associated Analytic Story==== @@ -2079,15 +2079,15 @@ This search looks at cloud-infrastructure events where an instance is created in ====Search==== -| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user -| `drop_dm_object_name("All_Changes")` -| lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenRegion=min(firstTimeSeen) -| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") -| table firstTime, user, dest, count , vendor_region -| `security_content_ctime(firstTime)` +| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user +| `drop_dm_object_name("All_Changes")` +| lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenRegion=min(firstTimeSeen) +| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") +| table firstTime, user, dest, count , vendor_region +| `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter` ====Associated Analytic Story==== @@ -2141,7 +2141,7 @@ This search looks for cloud compute instances being created with previously unse * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2018-10-12
@@ -2149,17 +2149,17 @@ This search looks for cloud compute instances being created with previously unse ====Search==== -| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user -| `drop_dm_object_name("All_Changes")` -| `drop_dm_object_name("Instance_Changes")` -| where image_id != "unknown" -| lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenImage=min(firstTimeSeen) -| where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") -| table firstTime, user, image_id, count, dest -| `security_content_ctime(firstTime)` +| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where image_id != "unknown" +| lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenImage=min(firstTimeSeen) +| where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") +| table firstTime, user, image_id, count, dest +| `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter` ====Associated Analytic Story==== @@ -2200,7 +2200,7 @@ Find EC2 instances being created with previously unseen instance types. * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-09-12
@@ -2208,17 +2208,17 @@ Find EC2 instances being created with previously unseen instance types. ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user -| `drop_dm_object_name("All_Changes")` -| `drop_dm_object_name("Instance_Changes")` -| where instance_type != "unknown" -| lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenInstanceType=min(firstTimeSeen) -| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") -| table firstTime, user, dest, count, instance_type -| `security_content_ctime(firstTime)` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where instance_type != "unknown" +| lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenInstanceType=min(firstTimeSeen) +| where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") +| table firstTime, user, dest, count, instance_type +| `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` ====Associated Analytic Story==== @@ -2267,15 +2267,15 @@ This search looks for cloud instances being modified by users who have not previ ====Search==== -| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user -| `drop_dm_object_name("All_Changes")` -| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenUser=min(firstTimeSeen) -| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") -| table firstTime user command object_id count -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenUser=min(firstTimeSeen) +| where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") +| table firstTime user command object_id count +| `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter` ====Associated Analytic Story==== @@ -2335,17 +2335,17 @@ This search looks for cloud provisioning activities from previously unseen citie ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command -| `drop_dm_object_name("All_Changes")` -| iplocation src -| where isnotnull(City) -| lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenCity=min(firstTimeSeen) -| where isnull(firstTimeSeenCity) OR firstTimeSeenCity > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) -| table firstTime, src, City, user, object, command -| `cloud_provisioning_activity_from_previously_unseen_city_filter` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(City) +| lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenCity=min(firstTimeSeen) +| where isnull(firstTimeSeenCity) OR firstTimeSeenCity > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) +| table firstTime, src, City, user, object, command +| `cloud_provisioning_activity_from_previously_unseen_city_filter` | `security_content_ctime(firstTime)` ====Associated Analytic Story==== @@ -2406,17 +2406,17 @@ This search looks for cloud provisioning activities from previously unseen count ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command -| `drop_dm_object_name("All_Changes")` -| iplocation src -| where isnotnull(Country) -| lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenCountry=min(firstTimeSeen) -| where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") -| table firstTime, src, Country, user, object, command -| `cloud_provisioning_activity_from_previously_unseen_country_filter` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Country) +| lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenCountry=min(firstTimeSeen) +| where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") +| table firstTime, src, Country, user, object, command +| `cloud_provisioning_activity_from_previously_unseen_country_filter` | `security_content_ctime(firstTime)` ====Associated Analytic Story==== @@ -2477,15 +2477,15 @@ This search looks for cloud provisioning activities from previously unseen IP ad ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command -| `drop_dm_object_name("All_Changes")` -| lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenSrc=min(firstTimeSeen) -| where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) -| table firstTime, src, user, object_id, command -| `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenSrc=min(firstTimeSeen) +| where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) +| table firstTime, src, user, object_id, command +| `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` | `security_content_ctime(firstTime)` ====Associated Analytic Story==== @@ -2546,17 +2546,17 @@ This search looks for cloud provisioning activities from previously unseen regio ====Search==== -| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command -| `drop_dm_object_name("All_Changes")` -| iplocation src -| where isnotnull(Region) -| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data -| eventstats max(enough_data) as enough_data -| where enough_data=1 -| eval firstTimeSeenRegion=min(firstTimeSeen) -| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) -| table firstTime, src, Region, user, object, command -| `cloud_provisioning_activity_from_previously_unseen_region_filter` +| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Region) +| lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data +| eventstats max(enough_data) as enough_data +| where enough_data=1 +| eval firstTimeSeenRegion=min(firstTimeSeen) +| where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) +| table firstTime, src, Region, user, object, command +| `cloud_provisioning_activity_from_previously_unseen_region_filter` | `security_content_ctime(firstTime)` ====Associated Analytic Story==== @@ -2609,7 +2609,7 @@ This search looks for CloudTrail events wherein a console login event by a user * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Authentication -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-28
@@ -2617,13 +2617,13 @@ This search looks for CloudTrail events wherein a console login event by a user ====Search==== -| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user -| `drop_dm_object_name(Authentication)` -| inputlookup append=t previously_seen_users_console_logins -| stats min(firstTime) as firstTime max(lastTime) as lastTime by user -| eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), "First Time Logging into AWS Console", "Previously Seen User") -|where userStatus="First Time Logging into AWS Console" -| `security_content_ctime(firstTime)` +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user +| `drop_dm_object_name(Authentication)` +| inputlookup append=t previously_seen_users_console_logins +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user +| eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), "First Time Logging into AWS Console", "Previously Seen User") +|where userStatus="First Time Logging into AWS Console" +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter` @@ -2675,20 +2675,20 @@ This search looks for CloudTrail events wherein a console login event by a user ====Search==== -| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src -| iplocation Authentication.src -| `drop_dm_object_name(Authentication)` -| table firstTime lastTime user City +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| `drop_dm_object_name(Authentication)` +| table firstTime lastTime user City | join user type=outer [ -| inputlookup previously_seen_users_console_logins -| stats earliest(firstTime) AS earliestseen by user City -| fields earliestseen user City] -| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") -| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") -| where userCity = "New City" AND userStatus != "Old User" -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table firstTime lastTime user City userStatus userCity +| inputlookup previously_seen_users_console_logins +| stats earliest(firstTime) AS earliestseen by user City +| fields earliestseen user City] +| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") +| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") +| where userCity = "New City" AND userStatus != "Old User" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter` ====Associated Analytic Story==== @@ -2752,20 +2752,20 @@ This search looks for CloudTrail events wherein a console login event by a user ====Search==== -| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src -| iplocation Authentication.src -| `drop_dm_object_name(Authentication)` -| table firstTime lastTime user Country +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| `drop_dm_object_name(Authentication)` +| table firstTime lastTime user Country | join user type=outer [ -| inputlookup previously_seen_users_console_logins -| stats earliest(firstTime) AS earliestseen by user Country -| fields earliestseen user Country] -| eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") -| eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") -| where userCountry = "New Country" AND userStatus != "Old User" -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table firstTime lastTime user Country userStatus userCountry +| inputlookup previously_seen_users_console_logins +| stats earliest(firstTime) AS earliestseen by user Country +| fields earliestseen user Country] +| eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") +| eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") +| where userCountry = "New Country" AND userStatus != "Old User" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter` ====Associated Analytic Story==== @@ -2829,20 +2829,20 @@ This search looks for CloudTrail events wherein a console login event by a user ====Search==== -| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src -| iplocation Authentication.src -| `drop_dm_object_name(Authentication)` -| table firstTime lastTime user Region +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| `drop_dm_object_name(Authentication)` +| table firstTime lastTime user Region | join user type=outer [ -| inputlookup previously_seen_users_console_logins -| stats earliest(firstTime) AS earliestseen by user Region -| fields earliestseen user Region] -| eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") -| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") -| where userRegion = "New Region" AND userStatus != "Old User" -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table firstTime lastTime user Region userStatus userRegion +| inputlookup previously_seen_users_console_logins +| stats earliest(firstTime) AS earliestseen by user Region +| fields earliestseen user Region] +| eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") +| eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") +| where userRegion = "New Region" AND userStatus != "Old User" +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter` ====Associated Analytic Story==== @@ -2897,7 +2897,7 @@ When a legitimate new user logins for the first time, this activity will be dete This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage bucket. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2020-08-10 @@ -2905,24 +2905,24 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl
====Search==== -`google_gcp_pubsub_message` -| multikv -| rename sc_status_ as status -| rename cs_object_ as bucket_name -| rename c_ip_ as remote_ip -| rename cs_uri_ as request_uri -| rename cs_method_ as operation -| search status="\"200\"" -| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri -| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri -| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv -| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri -| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv -| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) -| where newIP=1 -| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") -| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") -| table first_time last_time bucket_name remote_ip operation request_uri +`google_gcp_pubsub_message` +| multikv +| rename sc_status_ as status +| rename cs_object_ as bucket_name +| rename c_ip_ as remote_ip +| rename cs_uri_ as request_uri +| rename cs_method_ as operation +| search status="\"200\"" +| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip operation request_uri +| table firstTime, lastTime, bucket_name, remote_ip, operation, request_uri +| inputlookup append=t previously_seen_gcp_storage_access_from_remote_ip.csv +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip operation request_uri +| outputlookup previously_seen_gcp_storage_access_from_remote_ip.csv +| eval newIP=if(firstTime >= relative_time(now(),"-70m@m"), 1, 0) +| where newIP=1 +| eval first_time=strftime(firstTime,"%m/%d/%y %H:%M:%S") +| eval last_time=strftime(lastTime,"%m/%d/%y %H:%M:%S") +| table first_time last_time bucket_name remote_ip operation request_uri | `detect_gcp_storage_access_from_a_new_ip_filter` ====Associated Analytic Story==== @@ -2973,7 +2973,7 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2020-08-05 @@ -2981,16 +2981,16 @@ This search looks for GCP PubSub events where a user has created an open/public
====Search==== -`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions -| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action -| spath output=user path=data.protoPayload.authenticationInfo.principalEmail -| spath output=location path=data.protoPayload.resourceLocation.currentLocations{} -| spath output=src path=data.protoPayload.requestMetadata.callerIp -| spath output=bucketName path=data.protoPayload.resourceName -| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role -| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member -| search (member=allUsers AND action=ADD) -| table _time, bucketName, src, user, location, action, role, member +`google_gcp_pubsub_message` data.resource.type=gcs_bucket data.protoPayload.methodName=storage.setIamPermissions +| spath output=action path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.action +| spath output=user path=data.protoPayload.authenticationInfo.principalEmail +| spath output=location path=data.protoPayload.resourceLocation.currentLocations{} +| spath output=src path=data.protoPayload.requestMetadata.callerIp +| spath output=bucketName path=data.protoPayload.resourceName +| spath output=role path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.role +| spath output=member path=data.protoPayload.serviceData.policyDelta.bindingDeltas{}.member +| search (member=allUsers AND action=ADD) +| table _time, bucketName, src, user, location, action, role, member | search `detect_new_open_gcp_storage_buckets_filter` ====Associated Analytic Story==== @@ -3041,7 +3041,7 @@ While this search has no known false positives, it is possible that a GCP admin This search looks for CloudTrail events where a user has created an open/public S3 bucket over the aws cli. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2021-01-12 @@ -3049,12 +3049,12 @@ This search looks for CloudTrail events where a user has created an open/public
====Search==== -`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") -| rename requestParameters.bucketName AS bucketName -| fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control +`cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") +| rename requestParameters.bucketName AS bucketName +| fillnull +| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` ====Associated Analytic Story==== @@ -3107,7 +3107,7 @@ While this search has no known false positives, it is possible that an AWS admin This search looks for CloudTrail events where a user has created an open/public S3 bucket. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2021-01-12 @@ -3115,19 +3115,19 @@ This search looks for CloudTrail events where a user has created an open/public
====Search==== -`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl -| rex field=_raw "(?{.+})" -| spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} -| search grantees=* -| mvexpand grantees -| spath input=grantees output=uri path=Grantee.URI -| spath input=grantees output=permission path=Permission -| search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") -| search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") -| rename requestParameters.bucketName AS bucketName -| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName +`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl +| rex field=_raw "(?{.+})" +| spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} +| search grantees=* +| mvexpand grantees +| spath input=grantees output=uri path=Grantee.URI +| spath input=grantees output=permission path=Permission +| search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") +| search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") +| rename requestParameters.bucketName AS bucketName +| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` ====Associated Analytic Story==== @@ -3180,7 +3180,7 @@ While this search has no known false positives, it is possible that an AWS admin This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2018-06-28 @@ -3188,19 +3188,19 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
====Search==== -`aws_s3_accesslogs` http_status=200 [search `aws_s3_accesslogs` http_status=200 -| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip -| inputlookup append=t previously_seen_S3_access_from_remote_ip.csv -| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip -| outputlookup previously_seen_S3_access_from_remote_ip.csv -| eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newIP=1 +`aws_s3_accesslogs` http_status=200 [search `aws_s3_accesslogs` http_status=200 +| stats earliest(_time) as firstTime latest(_time) as lastTime by bucket_name remote_ip +| inputlookup append=t previously_seen_S3_access_from_remote_ip.csv +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by bucket_name remote_ip +| outputlookup previously_seen_S3_access_from_remote_ip.csv +| eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newIP=1 | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | table bucket_name remote_ip] -| iplocation remote_ip -|rename remote_ip as src_ip -| table _time bucket_name src_ip City Country operation request_uri +| iplocation remote_ip +|rename remote_ip as src_ip +| table _time bucket_name src_ip City Country operation request_uri | `detect_s3_access_from_a_new_ip_filter` ====Associated Analytic Story==== @@ -3251,22 +3251,22 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2021-01-26
====Search==== -`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance -| bucket span=4h _time -| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest -| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev -| eval threshold_value = 3 -| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) -| search isOutlier=1 -| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg +`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance +| bucket span=4h _time +| stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest +| eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev +| eval threshold_value = 3 +| eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) +| search isOutlier=1 +| table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter` ====Associated Analytic Story==== @@ -3306,23 +3306,23 @@ None This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2021-01-26
====Search==== -`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser -| rename findings{}.Resources{}.Id as user -| bucket span=4h _time -| stats count AS alerts by _time user -| eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev -| eval threshold_value = 2 -| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) -| search isOutlier=1 -| table _time user alerts +`aws_securityhub_finding` "findings{}.Resources{}.Type"= AwsIamUser +| rename findings{}.Resources{}.Id as user +| bucket span=4h _time +| stats count AS alerts by _time user +| eventstats avg(alerts) as total_launched_avg, stdev(alerts) as total_launched_stdev +| eval threshold_value = 2 +| eval isOutlier=if(alerts > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) +| search isOutlier=1 +| table _time user alerts |`detect_spike_in_aws_security_hub_alerts_for_user_filter` ====Associated Analytic Story==== @@ -3360,7 +3360,7 @@ None This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1530/ T1530] * '''Last Updated''': 2018-11-27 @@ -3368,26 +3368,26 @@ This search detects users creating spikes in API activity related to deletion of
====Search==== -`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=DeleteBucket -| spath output=arn path=userIdentity.arn -| stats count as apiCalls by arn -| inputlookup s3_deletion_baseline append=t -| fields - latestCount -| stats values(*) as * by arn -| rename apiCalls as latestCount -| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 -| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) -| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) -| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls -| outputlookup s3_deletion_baseline -| eval dataPointThreshold = 15, deviationThreshold = 3 -| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) -| where isSpike=1 -| rename arn as userIdentity.arn -| table userIdentity.arn] -| spath output=user userIdentity.arn -| spath output=bucketName path=requestParameters.bucketName -| stats values(bucketName) as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user +`cloudtrail` eventName=DeleteBucket [search `cloudtrail` eventName=DeleteBucket +| spath output=arn path=userIdentity.arn +| stats count as apiCalls by arn +| inputlookup s3_deletion_baseline append=t +| fields - latestCount +| stats values(*) as * by arn +| rename apiCalls as latestCount +| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 +| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) +| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup s3_deletion_baseline +| eval dataPointThreshold = 15, deviationThreshold = 3 +| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) +| where isSpike=1 +| rename arn as userIdentity.arn +| table userIdentity.arn] +| spath output=user userIdentity.arn +| spath output=bucketName path=requestParameters.bucketName +| stats values(bucketName) as bucketName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_s3_bucket_deletion_filter` ====Associated Analytic Story==== @@ -3438,30 +3438,30 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-05-07
====Search==== -`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) -| stats count as numberOfBlockedConnections by src_ip -| inputlookup baseline_blocked_outbound_connections append=t -| fields - latestCount -| stats values(*) as * by src_ip -| rename numberOfBlockedConnections as latestCount -| eval newAvgBlockedConnections=avgBlockedConnections + (latestCount-avgBlockedConnections)/720 -| eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) -| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) -| table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections -| outputlookup baseline_blocked_outbound_connections -| eval dataPointThreshold = 5, deviationThreshold = 3 -| eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) AND numDataPoints > dataPointThreshold, 1, 0) -| where isSpike=1 -| table src_ip] -| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections by src_ip +`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) [search `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) +| stats count as numberOfBlockedConnections by src_ip +| inputlookup baseline_blocked_outbound_connections append=t +| fields - latestCount +| stats values(*) as * by src_ip +| rename numberOfBlockedConnections as latestCount +| eval newAvgBlockedConnections=avgBlockedConnections + (latestCount-avgBlockedConnections)/720 +| eval newStdevBlockedConnections=sqrt(((pow(stdevBlockedConnections, 2)*719 + (latestCount-newAvgBlockedConnections)*(latestCount-avgBlockedConnections))/720)) +| eval avgBlockedConnections=coalesce(newAvgBlockedConnections, avgBlockedConnections), stdevBlockedConnections=coalesce(newStdevBlockedConnections, stdevBlockedConnections), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) +| table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections +| outputlookup baseline_blocked_outbound_connections +| eval dataPointThreshold = 5, deviationThreshold = 3 +| eval isSpike=if((latestCount > avgBlockedConnections+deviationThreshold*stdevBlockedConnections) AND numDataPoints > dataPointThreshold, 1, 0) +| where isSpike=1 +| table src_ip] +| stats values(dest_ip) as "Blocked Destination IPs", values(interface_id) as "resourceId" count as numberOfBlockedConnections, dc(dest_ip) as uniqueDestConnections by src_ip | `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` ====Associated Analytic Story==== @@ -3507,7 +3507,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges at different projects depending on organization schema. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-10-09 @@ -3515,8 +3515,8 @@ This search provides detection of accounts with high risk roles by projects. Com
====Search==== -`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor -| table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} +`google_gcp_pubsub_message` data.protoPayload.request.policy.bindings{}.role=roles/owner OR roles/editor OR roles/iam.serviceAccountUser OR roles/iam.serviceAccountAdmin OR roles/iam.serviceAccountTokenCreator OR roles/dataflow.developer OR roles/dataflow.admin OR roles/composer.admin OR roles/dataproc.admin OR roles/dataproc.editor +| table data.resource.type data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.authorizationInfo{}.resource data.protoPayload.response.bindings{}.role data.protoPayload.response.bindings{}.members{} | `gcp_detect_accounts_with_high_risk_roles_by_project_filter` ====Associated Analytic Story==== @@ -3573,7 +3573,7 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-10-08 @@ -3581,8 +3581,8 @@ This search provides detection of GCPloit exploitation framework. This framework
====Search==== -`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s -| table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent +`google_gcp_pubsub_message` data.protoPayload.request.function.timeout=539s +| table src src_user data.resource.labels.project_id data.protoPayload.request.function.serviceAccountEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.request.location http_user_agent | `gcp_detect_gcploit_framework_filter` ====Associated Analytic Story==== @@ -3637,7 +3637,7 @@ Payload.request.function.timeout value can possibly be match with other function This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts to move laterally and escalate privileges. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-10-09 @@ -3645,8 +3645,8 @@ This search provides detection of high risk permissions by resource and accounts
====Search==== -`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create -|table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id +`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.permission=iam.serviceAccounts.getaccesstoken OR iam.serviceAccounts.setIamPolicy OR iam.serviceAccounts.actas OR dataflow.jobs.create OR composer.environments.create OR dataproc.clusters.create +|table data.protoPayload.requestMetadata.callerIp data.protoPayload.authenticationInfo.principalEmail data.protoPayload.authorizationInfo{}.permission data.protoPayload.response.bindings{}.members{} data.resource.labels.project_id | `gcp_detect_high_risk_permissions_by_resource_and_account_filter` ====Associated Analytic Story==== @@ -3703,7 +3703,7 @@ High risk permissions are part of any GCP environment, however it is important t This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster's pods * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] * '''Last Updated''': 2020-07-17 @@ -3711,10 +3711,10 @@ This search provides information of unauthenticated requests via user agent, and
====Search==== -`google_gcp_pubsub_message` category=kube-audit -|spath input=properties.log -|search responseStatus.code=401 -|table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod +`google_gcp_pubsub_message` category=kube-audit +|spath input=properties.log +|search responseStatus.code=401 +|table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod | `gcp_kubernetes_cluster_pod_scan_detection_filter` ====Associated Analytic Story==== @@ -3765,7 +3765,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] * '''Last Updated''': 2020-04-15 @@ -3773,12 +3773,12 @@ This search provides information of unauthenticated requests via user agent, and
====Search==== -`google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" -| rename data.protoPayload.requestMetadata.callerIp as src_ip -| stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name +`google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerIp!=127.0.0.1 data.protoPayload.requestMetadata.callerIp!=::1 "data.labels.authorization.k8s.io/decision"=forbid "data.protoPayload.status.message"=PERMISSION_DENIED data.protoPayload.authenticationInfo.principalEmail="system:anonymous" +| rename data.protoPayload.requestMetadata.callerIp as src_ip +| stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_name values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent by src_ip data.resource.labels.cluster_name | rename data.resource.labels.cluster_name as cluster_name -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `gcp_kubernetes_cluster_scan_detection_filter` ====Associated Analytic Story==== @@ -3829,7 +3829,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1110.001/ T1110.001] * '''Last Updated''': 2020-12-16 @@ -3837,8 +3837,8 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir
====Search==== -`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory -| stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app +`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory +| stats count dc(user) as accounts_locked values(user) as user values(LogonError) as LogonError values(authentication_method) as authentication_method values(signature) as signature values(UserAgent) as UserAgent by src_ip record_type Operation app | search accounts_locked >= 5 | `high_number_of_login_failures_from_a_single_source_filter` @@ -3890,18 +3890,18 @@ unknown This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* -| table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason -| stats count by user.username annotations.authorization.k8s.io/reason -| rare user.username annotations.authorization.k8s.io/reason +`aws_cloudwatchlogs_eks` annotations.authorization.k8s.io/reason=* +| table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason +| stats count by user.username annotations.authorization.k8s.io/reason +| rare user.username annotations.authorization.k8s.io/reason |`kubernetes_aws_detect_rbac_authorization_by_account_filter` ====Associated Analytic Story==== @@ -3941,17 +3941,17 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts objectRef.resource=pods -| table sourceIPs{} user.username userAgent verb annotations.authorization.k8s.io/decision -| top sourceIPs{} user.username verb annotations.authorization.k8s.io/decision +`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts objectRef.resource=pods +| table sourceIPs{} user.username userAgent verb annotations.authorization.k8s.io/decision +| top sourceIPs{} user.username verb annotations.authorization.k8s.io/decision |`kubernetes_aws_detect_most_active_service_accounts_by_pod_filter` ====Associated Analytic Story==== @@ -3991,17 +3991,17 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 -| table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason -| dedup user.username user.groups{} +`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrolebindings sourceIPs{}!=::1 sourceIPs{}!=127.0.0.1 +| table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason +| dedup user.username user.groups{} |`kubernetes_aws_detect_sensitive_role_access_filter` ====Associated Analytic Story==== @@ -4023,7 +4023,7 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit ====Known False Positives==== -Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. +Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. ====Reference==== @@ -4041,16 +4041,16 @@ Sensitive role resource access is necessary for cluster operation, however sourc This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts responseStatus.status = Failure -| table sourceIPs{} user.username userAgent verb responseStatus.status requestURI +`aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts responseStatus.status = Failure +| table sourceIPs{} user.username userAgent verb responseStatus.status requestURI | `kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter` ====Associated Analytic Story==== @@ -4090,17 +4090,17 @@ This search can give false positives as there might be inherent issues with auth This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous -| table src_ip src_user verb userAgent requestURI -| stats count by src_ip src_user verb userAgent requestURI +`aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous +| table src_ip src_user verb userAgent requestURI +| stats count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter` ====Associated Analytic Story==== @@ -4140,20 +4140,20 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-26
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| search annotations.authorization.k8s.io/reason=* -| table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason -|stats count by user.username annotations.authorization.k8s.io/reason -| rare user.username annotations.authorization.k8s.io/reason +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search annotations.authorization.k8s.io/reason=* +| table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason +|stats count by user.username annotations.authorization.k8s.io/reason +| rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter` ====Associated Analytic Story==== @@ -4193,19 +4193,19 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-26
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow -| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace -| top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow +| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace +| top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter` ====Associated Analytic Story==== @@ -4245,19 +4245,19 @@ Not all service accounts interactions are malicious. Analyst must consider IP an This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-20
====Search==== -`kubernetes_azure` category=kube-audit +`kubernetes_azure` category=kube-audit | spath input=properties.log -| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow -|table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason -|dedup user.username user.groups{} +| search objectRef.resource=secrets OR configmaps user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow +|table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason +|dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter` ====Associated Analytic Story==== @@ -4297,19 +4297,19 @@ Sensitive object access is not necessarily malicious but user and object context This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-20
====Search==== -`kubernetes_azure` category=kube-audit +`kubernetes_azure` category=kube-audit | spath input=properties.log -| search objectRef.resource=clusterroles OR clusterrolebindings -| table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason -| dedup user.username user.groups{} +| search objectRef.resource=clusterroles OR clusterrolebindings +| table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason +| dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter` ====Associated Analytic Story==== @@ -4331,7 +4331,7 @@ You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audi ====Known False Positives==== -Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. +Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. ====Reference==== @@ -4349,18 +4349,18 @@ Sensitive role resource access is necessary for cluster operation, however sourc This search provides information on Kubernetes service accounts with failure or forbidden access status * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-20
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| search user.groups{}=system:serviceaccounts* responseStatus.reason=Forbidden -| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search user.groups{}=system:serviceaccounts* responseStatus.reason=Forbidden +| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter` ====Associated Analytic Story==== @@ -4400,20 +4400,20 @@ This search can give false positives as there might be inherent issues with auth This search provides information on rare Kubectl calls with IP, verb namespace and object access context * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-26
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| spath input=responseObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration -| search userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 -| table sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI -| rare sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| spath input=responseObject.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration +| search userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 +| table sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI +| rare sourceIPs{} verb userAgent user.groups{} objectRef.resource objectRef.namespace requestURI |`kubernetes_azure_detect_suspicious_kubectl_calls_filter` ====Associated Analytic Story==== @@ -4453,18 +4453,18 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-05-20
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| search responseStatus.code=401 -| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search responseStatus.code=401 +| table sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter` ====Associated Analytic Story==== @@ -4504,7 +4504,7 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] * '''Last Updated''': 2020-05-19 @@ -4512,10 +4512,10 @@ This search provides information of unauthenticated requests via source IP user
====Search==== -`kubernetes_azure` category=kube-audit -| spath input=properties.log -| search responseStatus.code=401 -| table sourceIPs{} userAgent verb requestURI responseStatus.reason +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search responseStatus.code=401 +| table sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter` ====Associated Analytic Story==== @@ -4566,17 +4566,17 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-07-11
====Search==== -`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole -| table src_ip src_user data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason -| rare src_user data.labels.authorization.k8s.io/reason +`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole +| table src_ip src_user data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason +| rare src_user data.labels.authorization.k8s.io/reason |`kubernetes_gcp_detect_rbac_authorizations_by_account_filter` ====Associated Analytic Story==== @@ -4616,17 +4616,17 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-07-10
====Search==== -`google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts -| table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource -| top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource +`google_gcp_pubsub_message` data.protoPayload.request.spec.group{}=system:serviceaccounts +| table src_ip src_user http_user_agent data.protoPayload.request.spec.nonResourceAttributes.verb data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource +| top src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.protoPayload.response.spec.resourceAttributes.resource |`kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter` ====Associated Analytic Story==== @@ -4666,17 +4666,17 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-07-11
====Search==== -`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets -| table data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name data.protoPayload.request.metadata.namespace data.labels.authorization.k8s.io/decision -| dedup data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name +`google_gcp_pubsub_message` data.protoPayload.authorizationInfo{}.resource=configmaps OR secrets +| table data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name data.protoPayload.request.metadata.namespace data.labels.authorization.k8s.io/decision +| dedup data.protoPayload.requestMetadata.callerIp src_user data.resource.labels.cluster_name |`kubernetes_gcp_detect_sensitive_object_access_filter` ====Associated Analytic Story==== @@ -4716,17 +4716,17 @@ Sensitive object access is not necessarily malicious but user and object context This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-07-11
====Search==== -`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole dest=apis/rbac.authorization.k8s.io/v1 src_ip!=::1 -| table src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason -| dedup src_ip src_user +`google_gcp_pubsub_message` data.labels.authorization.k8s.io/reason=ClusterRoleBinding OR Clusterrole dest=apis/rbac.authorization.k8s.io/v1 src_ip!=::1 +| table src_ip src_user http_user_agent data.labels.authorization.k8s.io/decision data.labels.authorization.k8s.io/reason +| dedup src_ip src_user |`kubernetes_gcp_detect_sensitive_role_access_filter` ====Associated Analytic Story==== @@ -4748,7 +4748,7 @@ You must install splunk add on for GCP. This search works with pubsub messaging ====Known False Positives==== -Sensitive role resource access is necessary for cluster operation, however source IP, user agent, decision and reason may indicate possible malicious use. +Sensitive role resource access is necessary for cluster operation, however source IP, user agent, decision and reason may indicate possible malicious use. ====Reference==== @@ -4766,17 +4766,17 @@ Sensitive role resource access is necessary for cluster operation, however sourc This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or rare operators to find trends or rarities in failure status, user agents, source IPs and request URI * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-06-23
====Search==== -`google_gcp_pubsub_message` system:serviceaccounts data.protoPayload.response.status.allowed!=* -| table src_ip src_user http_user_agent data.protoPayload.response.spec.resourceAttributes.namespace data.resource.labels.cluster_name data.protoPayload.response.spec.resourceAttributes.verb data.protoPayload.request.status.allowed data.protoPayload.response.status.reason data.labels.authorization.k8s.io/decision -| dedup src_ip src_user +`google_gcp_pubsub_message` system:serviceaccounts data.protoPayload.response.status.allowed!=* +| table src_ip src_user http_user_agent data.protoPayload.response.spec.resourceAttributes.namespace data.resource.labels.cluster_name data.protoPayload.response.spec.resourceAttributes.verb data.protoPayload.request.status.allowed data.protoPayload.response.status.reason data.labels.authorization.k8s.io/decision +| dedup src_ip src_user | `kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter` ====Associated Analytic Story==== @@ -4816,17 +4816,17 @@ This search can give false positives as there might be inherent issues with auth This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-07-11
====Search==== -`google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerSuppliedUserAgent=kubectl* src_user=system:unsecured OR src_user=system:anonymous -| table src_ip src_user data.protoPayload.requestMetadata.callerSuppliedUserAgent data.protoPayload.authorizationInfo{}.granted object_path -|dedup src_ip src_user +`google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerSuppliedUserAgent=kubectl* src_user=system:unsecured OR src_user=system:anonymous +| table src_ip src_user data.protoPayload.requestMetadata.callerSuppliedUserAgent data.protoPayload.authorizationInfo{}.granted object_path +|dedup src_ip src_user |`kubernetes_gcp_detect_suspicious_kubectl_calls_filter` ====Associated Analytic Story==== @@ -4866,7 +4866,7 @@ Kubectl calls are not malicious by nature. However source IP, source user, user This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1525/ T1525] * '''Last Updated''': 2020-02-20 @@ -4875,8 +4875,8 @@ This searches show information on uploaded containers including source user, ima ====Search==== -| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type -| `drop_dm_object_name("Compute")` +| tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type +| `drop_dm_object_name("Compute")` | `new_container_uploaded_to_aws_ecr_filter` ====Associated Analytic Story==== @@ -4925,7 +4925,7 @@ Uploading container is a normal behavior from developers or users with access to This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.003/ T1136.003] * '''Last Updated''': 2021-01-26 @@ -4933,10 +4933,10 @@ This search detects the creation of a new Federation setting by alerting about a
====Search==== -`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." -| stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus +`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." +| stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter` ====Associated Analytic Story==== @@ -4995,7 +4995,7 @@ The creation of a new Federation is not necessarily malicious, however this even This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.003/ T1136.003] * '''Last Updated''': 2021-01-26 @@ -5003,10 +5003,10 @@ This search detects the creation of a new Federation setting by alerting about a
====Search==== -`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." -| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature +`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." +| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter` ====Associated Analytic Story==== @@ -5069,7 +5069,7 @@ The creation of a new Federation is not necessarily malicious, however these eve This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007] * '''Last Updated''': 2021-01-12 @@ -5077,13 +5077,13 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus
====Search==== -`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy -| rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" -| rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" -| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") -| mvexpand ip_addresses_new_added -| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) -|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action +`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy +| rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" +| rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" +| eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") +| mvexpand ip_addresses_new_added +| where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) +|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_bypass_mfa_via_trusted_ip_filter` @@ -5142,7 +5142,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1556/ T1556] * '''Last Updated''': 2020-12-16 @@ -5150,10 +5150,10 @@ This search detects when multi factor authentication has been disabled, what ent
====Search==== -`o365_management_activity` Operation="Disable Strong Authentication." -| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Operation="Disable Strong Authentication." +| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `o365_disable_mfa_filter` ====Associated Analytic Story==== @@ -5208,7 +5208,7 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1110/ T1110] * '''Last Updated''': 2020-12-16 @@ -5216,11 +5216,11 @@ This search detects when an excessive number of authentication failures occur th
====Search==== -`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed -| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user -| where count > 10 -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed +| stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user +| where count > 10 +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter` ====Associated Analytic Story==== @@ -5275,7 +5275,7 @@ The threshold for alert is above 10 attempts and this should reduce the number o This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1556/ T1556] * '''Last Updated''': 2021-01-26 @@ -5283,11 +5283,11 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro
====Search==== -`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired -| stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId -| where count > 5 +`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired +| stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId +| where count > 5 | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter` ====Associated Analytic Story==== @@ -5344,7 +5344,7 @@ Logon errors may not be malicious in nature however it may indicate attempts to This search detects the addition of a new Federated domain. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.003/ T1136.003] * '''Last Updated''': 2021-01-26 @@ -5352,10 +5352,10 @@ This search detects the addition of a new Federated domain.
====Search==== -`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" -| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" +| stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter` ====Associated Analytic Story==== @@ -5420,7 +5420,7 @@ The creation of a new Federated domain is not necessarily malicious, however the This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1114/ T1114] * '''Last Updated''': 2020-12-16 @@ -5428,10 +5428,10 @@ This search detects when a user has performed an Ediscovery search or exported a
====Search==== -`o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" -| stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" +| stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter` ====Associated Analytic Story==== @@ -5486,7 +5486,7 @@ PST export can be done for legitimate purposes but due to the sensitive nature o This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1114.003/ T1114.003] * '''Last Updated''': 2020-12-16 @@ -5494,14 +5494,14 @@ This search detects when an admin configured a forwarding rule for multiple mail
====Search==== -`o365_management_activity` Operation=Set-Mailbox -| spath input=Parameters -| rename Identity AS src_user -| search ForwardingAddress=* -| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress -| where count_src_user > 1 -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Operation=Set-Mailbox +| spath input=Parameters +| rename Identity AS src_user +| search ForwardingAddress=* +| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress +| where count_src_user > 1 +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter` ====Associated Analytic Story==== @@ -5554,7 +5554,7 @@ unknown This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1114.002/ T1114.002] * '''Last Updated''': 2020-12-15 @@ -5562,13 +5562,13 @@ This search detects the assignment of rights to accesss content from another mai
====Search==== -`o365_management_activity` Operation=Add-MailboxPermission -| spath input=Parameters -| rename User AS src_user, Identity AS dest_user -| search AccessRights=FullAccess OR AccessRights=SendAs OR AccessRights=SendOnBehalf -| stats count earliest(_time) as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Operation=Add-MailboxPermission +| spath input=Parameters +| rename User AS src_user, Identity AS dest_user +| search AccessRights=FullAccess OR AccessRights=SendAs OR AccessRights=SendOnBehalf +| stats count earliest(_time) as firstTime latest(_time) as lastTime by user src_user dest_user Operation AccessRights +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` |`o365_suspicious_rights_delegation_filter` ====Associated Analytic Story==== @@ -5621,7 +5621,7 @@ Service Accounts This search detects when multiple user configured a forwarding rule to the same destination. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1114.003/ T1114.003] * '''Last Updated''': 2020-12-16 @@ -5629,14 +5629,14 @@ This search detects when multiple user configured a forwarding rule to the same
====Search==== -`o365_management_activity` Operation=Set-Mailbox -| spath input=Parameters -| rename Identity AS src_user -| search ForwardingSmtpAddress=* -| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress -| where count_src_user > 1 -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`o365_management_activity` Operation=Set-Mailbox +| spath input=Parameters +| rename Identity AS src_user +| search ForwardingSmtpAddress=* +| stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress +| where count_src_user > 1 +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter` ====Associated Analytic Story==== @@ -5689,7 +5689,7 @@ unknown This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-07-27 @@ -5698,8 +5698,8 @@ This search provides detection of an user attaching itself to a different role t ====Search==== `aws_cloudwatchlogs_eks` attach policy -| spath requestParameters.policyArn -| table sourceIPAddress user_access_key userIdentity.arn userIdentity.sessionContext.sessionIssuer.arn eventName errorCode errorMessage status action requestParameters.policyArn userIdentity.sessionContext.attributes.mfaAuthenticated userIdentity.sessionContext.attributes.creationDate +| spath requestParameters.policyArn +| table sourceIPAddress user_access_key userIdentity.arn userIdentity.sessionContext.sessionIssuer.arn eventName errorCode errorMessage status action requestParameters.policyArn userIdentity.sessionContext.attributes.mfaAuthenticated userIdentity.sessionContext.attributes.creationDate | `aws_detect_attach_to_role_policy_filter` ====Associated Analytic Story==== @@ -5750,7 +5750,7 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. Creation of Permanent key is an important event to monitor. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-07-27 @@ -5758,10 +5758,10 @@ This search provides detection of accounts creating permanent keys. Permanent ke
====Search==== -`aws_cloudwatchlogs_eks` CreateAccessKey -| spath eventName -| search eventName=CreateAccessKey "userIdentity.type"=IAMUser -| table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId +`aws_cloudwatchlogs_eks` CreateAccessKey +| spath eventName +| search eventName=CreateAccessKey "userIdentity.type"=IAMUser +| table sourceIPAddress userName userIdentity.type userAgent action status responseElements.accessKey.createDate responseElements.accessKey.status responseElements.accessKey.accessKeyId |`aws_detect_permanent_key_creation_filter` ====Associated Analytic Story==== @@ -5812,7 +5812,7 @@ Not all permanent key creations are malicious. If there is a policy of rotating This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different than the available in AWS and it can be used for lateral movement and escalation of privileges. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-07-27 @@ -5820,8 +5820,8 @@ This search provides detection of role creation by IAM users. Role creation is a
====Search==== -`aws_cloudwatchlogs_eks` event_name=CreateRole action=created userIdentity.type=AssumedRole requestParameters.description=Allows* -| table sourceIPAddress userIdentity.principalId userIdentity.arn action event_name awsRegion http_user_agent mfa_auth msg requestParameters.roleName requestParameters.description responseElements.role.arn responseElements.role.createDate +`aws_cloudwatchlogs_eks` event_name=CreateRole action=created userIdentity.type=AssumedRole requestParameters.description=Allows* +| table sourceIPAddress userIdentity.principalId userIdentity.arn action event_name awsRegion http_user_agent mfa_auth msg requestParameters.roleName requestParameters.description responseElements.role.arn responseElements.role.createDate | `aws_detect_role_creation_filter` ====Associated Analytic Story==== @@ -5872,7 +5872,7 @@ CreateRole is not very common in common users. This search can be adjusted to pr This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-07-27 @@ -5880,8 +5880,8 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens
====Search==== -`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role -| table sourceIPAddress userIdentity.arn user_agent user_access_key status action requestParameters.roleName responseElements.role.roleName responseElements.role.createDate +`cloudtrail` user_type=AssumedRole userIdentity.sessionContext.sessionIssuer.type=Role +| table sourceIPAddress userIdentity.arn user_agent user_access_key status action requestParameters.roleName responseElements.role.roleName responseElements.role.createDate | `aws_detect_sts_assume_role_abuse_filter` ====Associated Analytic Story==== @@ -5932,7 +5932,7 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and escalate privileges. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1550/ T1550] * '''Last Updated''': 2020-07-27 @@ -5941,9 +5941,9 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t ====Search==== `aws_cloudwatchlogs_eks` ASIA userIdentity.type=IAMUser -| spath eventName -| search eventName=GetSessionToken -| table sourceIPAddress eventTime userIdentity.arn userName userAgent user_type status region +| spath eventName +| search eventName=GetSessionToken +| table sourceIPAddress eventTime userIdentity.arn userName userAgent user_type status region | `aws_detect_sts_get_session_token_abuse_filter` ====Associated Analytic Story==== @@ -5994,7 +5994,7 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access sessions alive without further control of authentication, allowing attackers to access and move laterally. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-09-01 @@ -6002,8 +6002,8 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke
====Search==== -`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog -|table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message +`google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog +|table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message | `gcp_detect_oauth_token_abuse_filter` ====Associated Analytic Story==== @@ -6060,10 +6060,10 @@ GCP Oauth token abuse detection will only work if there are access policies in p ===Aws cloud provisioning from previously unseen city=== -This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. +This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535] * '''Last Updated''': 2018-03-16 @@ -6071,22 +6071,22 @@ This search looks for AWS provisioning activities from previously unseen cities.
====Search==== -`cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search City=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search City=* -| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country -| inputlookup append=t previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country -| outputlookup previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by City -| eval newCity=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newCity=1 -| table City] -| spath output=user userIdentity.arn -| rename sourceIPAddress as src_ip -| table _time, user, src_ip, City, eventName, errorCode +`cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search City=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search City=* +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| inputlookup append=t previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by City +| eval newCity=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newCity=1 +| table City] +| spath output=user userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, City, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_city_filter` ====Associated Analytic Story==== @@ -6133,10 +6133,10 @@ This is a strictly behavioral search, so we define "false positive" slightly dif ---- ===Aws cloud provisioning from previously unseen country=== -This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. +This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535] * '''Last Updated''': 2018-03-16 @@ -6144,22 +6144,22 @@ This search looks for AWS provisioning activities from previously unseen countri
====Search==== -`cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search Country=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search Country=* -| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country -| inputlookup append=t previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country -| outputlookup previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by Country -| eval newCountry=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newCountry=1 -| table Country] -| spath output=user userIdentity.arn -| rename sourceIPAddress as src_ip -| table _time, user, src_ip, Country, eventName, errorCode +`cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search Country=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search Country=* +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| inputlookup append=t previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by Country +| eval newCountry=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newCountry=1 +| table Country] +| spath output=user userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, Country, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_country_filter` ====Associated Analytic Story==== @@ -6206,31 +6206,31 @@ This is a strictly behavioral search, so we define "false positive" slightly dif ---- ===Aws cloud provisioning from previously unseen ip address=== -This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. +This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-03-16
====Search==== -`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search Country=* -| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country -| inputlookup append=t previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country -| outputlookup previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress -| eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newIP=1 -| table sourceIPAddress] -| spath output=user userIdentity.arn -| rename sourceIPAddress as src_ip -| table _time, user, src_ip, eventName, errorCode +`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search Country=* +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| inputlookup append=t previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress +| eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newIP=1 +| table sourceIPAddress] +| spath output=user userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_ip_address_filter` ====Associated Analytic Story==== @@ -6269,7 +6269,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535] * '''Last Updated''': 2018-03-16 @@ -6277,22 +6277,22 @@ This search looks for AWS provisioning activities from previously unseen regions
====Search==== -`cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search Region=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) -| iplocation sourceIPAddress -| search Region=* -| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country -| inputlookup append=t previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country -| outputlookup previously_seen_provisioning_activity_src.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by Region -| eval newRegion=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newRegion=1 -| table Region] -| spath output=user userIdentity.arn -| rename sourceIPAddress as src_ip -| table _time, user, src_ip, Region, eventName, errorCode +`cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search Region=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| search Region=* +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| inputlookup append=t previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by Region +| eval newRegion=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newRegion=1 +| table Region] +| spath output=user userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, Region, eventName, errorCode | `aws_cloud_provisioning_from_previously_unseen_region_filter` ====Associated Analytic Story==== @@ -6342,7 +6342,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -6350,15 +6350,15 @@ This search looks for CloudTrail events where a user successfully launches an ab
====Search==== -`cloudtrail` eventName=RunInstances errorCode=success -| bucket span=10m _time -| stats count AS instances_launched by _time userName -| eventstats avg(instances_launched) as total_launched_avg, stdev(instances_launched) as total_launched_stdev -| eval threshold_value = 4 -| eval isOutlier=if(instances_launched > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) -| search isOutlier=1 AND _time >= relative_time(now(), "-10m@m") -| eval num_standard_deviations_away = round(abs(instances_launched - total_launched_avg) / total_launched_stdev, 2) -| table _time, userName, instances_launched, num_standard_deviations_away, total_launched_avg, total_launched_stdev +`cloudtrail` eventName=RunInstances errorCode=success +| bucket span=10m _time +| stats count AS instances_launched by _time userName +| eventstats avg(instances_launched) as total_launched_avg, stdev(instances_launched) as total_launched_stdev +| eval threshold_value = 4 +| eval isOutlier=if(instances_launched > total_launched_avg+(total_launched_stdev * threshold_value), 1, 0) +| search isOutlier=1 AND _time >= relative_time(now(), "-10m@m") +| eval num_standard_deviations_away = round(abs(instances_launched - total_launched_avg) / total_launched_stdev, 2) +| table _time, userName, instances_launched, num_standard_deviations_away, total_launched_avg, total_launched_stdev | `abnormally_high_aws_instances_launched_by_user_filter` ====Associated Analytic Story==== @@ -6411,7 +6411,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib This search looks for CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -6419,11 +6419,11 @@ This search looks for CloudTrail events where a user successfully launches an ab
====Search==== -`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter` -| bucket span=10m _time -| stats count as instances_launched by _time src_user -| apply ec2_excessive_runinstances_v1 -| rename "IsOutlier(instances_launched)" as isOutlier +`cloudtrail` eventName=RunInstances errorCode=success `abnormally_high_aws_instances_launched_by_user___mltk_filter` +| bucket span=10m _time +| stats count as instances_launched by _time src_user +| apply ec2_excessive_runinstances_v1 +| rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 ====Associated Analytic Story==== @@ -6476,7 +6476,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib This search looks for CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -6484,15 +6484,15 @@ This search looks for CloudTrail events where an abnormally high number of insta
====Search==== -`cloudtrail` eventName=TerminateInstances errorCode=success -| bucket span=10m _time -| stats count AS instances_terminated by _time userName -| eventstats avg(instances_terminated) as total_terminations_avg, stdev(instances_terminated) as total_terminations_stdev -| eval threshold_value = 4 -| eval isOutlier=if(instances_terminated > total_terminations_avg+(total_terminations_stdev * threshold_value), 1, 0) +`cloudtrail` eventName=TerminateInstances errorCode=success +| bucket span=10m _time +| stats count AS instances_terminated by _time userName +| eventstats avg(instances_terminated) as total_terminations_avg, stdev(instances_terminated) as total_terminations_stdev +| eval threshold_value = 4 +| eval isOutlier=if(instances_terminated > total_terminations_avg+(total_terminations_stdev * threshold_value), 1, 0) | search isOutlier=1 AND _time >= relative_time(now(), "-10m@m") -| eval num_standard_deviations_away = round(abs(instances_terminated - total_terminations_avg) / total_terminations_stdev, 2) -|table _time, userName, instances_terminated, num_standard_deviations_away, total_terminations_avg, total_terminations_stdev +| eval num_standard_deviations_away = round(abs(instances_terminated - total_terminations_avg) / total_terminations_stdev, 2) +|table _time, userName, instances_terminated, num_standard_deviations_away, total_terminations_avg, total_terminations_stdev | `abnormally_high_aws_instances_terminated_by_user_filter` ====Associated Analytic Story==== @@ -6543,7 +6543,7 @@ Many service accounts configured with your AWS infrastructure are known to exhib This search looks for CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -6551,11 +6551,11 @@ This search looks for CloudTrail events where a user successfully terminates an
====Search==== -`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter` -| bucket span=10m _time -| stats count as instances_terminated by _time src_user -| apply ec2_excessive_terminateinstances_v1 -| rename "IsOutlier(instances_terminated)" as isOutlier +`cloudtrail` eventName=TerminateInstances errorCode=success `abnormally_high_aws_instances_terminated_by_user___mltk_filter` +| bucket span=10m _time +| stats count as instances_terminated by _time src_user +| apply ec2_excessive_terminateinstances_v1 +| rename "IsOutlier(instances_terminated)" as isOutlier | where isOutlier=1 ====Associated Analytic Story==== @@ -6615,9 +6615,9 @@ This search allows you to identify the endpoints that have connected to more tha ====Search==== -| tstats `security_content_summariesonly` count, values(DNS.dest) AS dest dc(DNS.dest) as dest_count from datamodel=Network_Resolution where DNS.message_type=QUERY by DNS.src -| `drop_dm_object_name("Network_Resolution")` -|where dest_count > 5 +| tstats `security_content_summariesonly` count, values(DNS.dest) AS dest dc(DNS.dest) as dest_count from datamodel=Network_Resolution where DNS.message_type=QUERY by DNS.src +| `drop_dm_object_name("Network_Resolution")` +|where dest_count > 5 | `clients_connecting_to_multiple_dns_servers_filter` ====Associated Analytic Story==== @@ -6676,8 +6676,8 @@ It's possible that an enterprise has more than five DNS servers that are configu Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-09-08
@@ -6685,10 +6685,10 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo ====Search==== `cloudtrail` eventName=DeleteNetworkAcl -|rename userIdentity.arn as arn -| stats count min(_time) as firstTime max(_time) as lastTime values(errorMessage) values(errorCode) values(userAgent) values(userIdentity.*) by src userName arn eventName -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +|rename userIdentity.arn as arn +| stats count min(_time) as firstTime max(_time) as lastTime values(errorMessage) values(errorCode) values(userAgent) values(userIdentity.*) by src userName arn eventName +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `cloud_network_access_control_list_deleted_filter` ====Associated Analytic Story==== @@ -6737,8 +6737,8 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.dest_category != dns_server AND DNS.src_category != dns_server by DNS.src DNS.dest -| `drop_dm_object_name("DNS")` +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.dest_category != dns_server AND DNS.src_category != dns_server by DNS.src DNS.dest +| `drop_dm_object_name("DNS")` | `dns_query_requests_resolved_by_unauthorized_dns_servers_filter` ====Associated Analytic Story==== @@ -6795,22 +6795,22 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and This search looks for CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-05-17
====Search==== -`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=false +`cloudtrail` userIdentity.sessionContext.attributes.mfaAuthenticated=false | search NOT [ -| inputlookup aws_service_accounts -| fields identity +| inputlookup aws_service_accounts +| fields identity | rename identity as user] -| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by userIdentity.arn userIdentity.type user -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by userIdentity.arn userIdentity.type user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_api_activity_from_users_without_mfa_filter` ====Associated Analytic Story==== @@ -6854,7 +6854,7 @@ Many service accounts configured within an AWS infrastructure do not have multi This search looks for successful CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns event names and count, as well as the first and last time a specific user or service is detected, grouped by users. Deprecated because managing this list can be quite hard. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -6862,18 +6862,18 @@ This search looks for successful CloudTrail activity by user accounts that are n
====Search==== -`cloudtrail` errorCode=success -| rename userName as identity +`cloudtrail` errorCode=success +| rename userName as identity | search NOT [ -| inputlookup identity_lookup_expanded -| fields identity] +| inputlookup identity_lookup_expanded +| fields identity] | search NOT [ -| inputlookup aws_service_accounts -| fields identity] -| rename identity as user -| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by user -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| inputlookup aws_service_accounts +| fields identity] +| rename identity as user +| stats count min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName by user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_aws_api_activities_from_unapproved_accounts_filter` ====Associated Analytic Story==== @@ -6939,21 +6939,21 @@ This search looks for DNS requests for phishing domains that are leveraging Evil ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution.DNS by DNS.dest DNS.src DNS.query host +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(DNS.answer) as answer from datamodel=Network_Resolution.DNS by DNS.dest DNS.src DNS.query host | `drop_dm_object_name(DNS)` | rex field=query ".*?(?[^./:]+\.(\S{2,3} -|\S{2,3}.\S{2,3}))$" +|\S{2,3}.\S{2,3}))$" | stats count values(query) as query by domain dest src answer -| search `evilginx_phishlets_amazon` OR `evilginx_phishlets_facebook` OR `evilginx_phishlets_github` OR `evilginx_phishlets_0365` OR `evilginx_phishlets_outlook` OR `evilginx_phishlets_aws` OR `evilginx_phishlets_google` -| search NOT [ inputlookup legit_domains.csv +| search `evilginx_phishlets_amazon` OR `evilginx_phishlets_facebook` OR `evilginx_phishlets_github` OR `evilginx_phishlets_0365` OR `evilginx_phishlets_outlook` OR `evilginx_phishlets_aws` OR `evilginx_phishlets_google` +| search NOT [ inputlookup legit_domains.csv | fields domain] | join domain type=outer [ -| tstats count `security_content_summariesonly` values(Web.url) as url from datamodel=Web.Web by Web.dest Web.site -| rename "Web.*" as * +| tstats count `security_content_summariesonly` values(Web.url) as url from datamodel=Web.Web by Web.dest Web.site +| rename "Web.*" as * | rex field=site ".*?(?[^./:]+\.(\S{2,3} -|\S{2,3}.\S{2,3}))$" -| table dest domain url] -| table count src dest query answer domain url +|\S{2,3}.\S{2,3}))$" +| table dest domain url] +| table count src dest query answer domain url | `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` ====Associated Analytic Story==== @@ -7019,14 +7019,14 @@ This search is used to detect attempts to use DNS tunneling, by calculating the ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type -| `drop_dm_object_name("DNS")` -| eval anslen=len(answer) -| search anslen>100 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rename src as "Source IP", dest as "Destination IP", answer as "DNS Answer" anslen as "Answer Length" record_type as "DNS Record Type" firstTime as "First Time" lastTime as "Last Time" count as Count -| table "Source IP" "Destination IP" "DNS Answer" "DNS Record Type" "Answer Length" Count "First Time" "Last Time" +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=response AND DNS.record_type=TXT by DNS.src DNS.dest DNS.answer DNS.record_type +| `drop_dm_object_name("DNS")` +| eval anslen=len(answer) +| search anslen>100 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| rename src as "Source IP", dest as "Destination IP", answer as "DNS Answer" anslen as "Answer Length" record_type as "DNS Record Type" firstTime as "First Time" lastTime as "Last Time" count as Count +| table "Source IP" "Destination IP" "DNS Answer" "DNS Record Type" "Answer Length" Count "First Time" "Last Time" | `detect_long_dns_txt_record_response_filter` ====Associated Analytic Story==== @@ -7079,7 +7079,7 @@ It's possible that legitimate TXT record responses can be long enough to trigger This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-12-03 @@ -7087,12 +7087,12 @@ This search looks for reading loaded Images unique to credential dumping with Mi
====Search==== -`sysmon` EventCode=7 -| stats values(ImageLoaded) as ImageLoaded values(ProcessId) as ProcessId by Computer, Image -| search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll -| rename Computer as dest +`sysmon` EventCode=7 +| stats values(ImageLoaded) as ImageLoaded values(ProcessId) as ProcessId by Computer, Image +| search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll +| rename Computer as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter` ====Associated Analytic Story==== @@ -7149,7 +7149,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist. This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-02-27 @@ -7157,14 +7157,14 @@ This search looks for PowerShell requesting privileges consistent with credentia
====Search==== -`wineventlog_security` signature_id=4703 Process_Name=*powershell.exe -| rex field=Message "Enabled Privileges:\s+(?\w+)\s+Disabled Privileges:" -| where privs="SeDebugPrivilege" -| stats count min(_time) as firstTime max(_time) as lastTime by dest, Process_Name, privs, Process_ID, Message -| rename privs as "Enabled Privilege" -| rename Process_Name as process +`wineventlog_security` signature_id=4703 Process_Name=*powershell.exe +| rex field=Message "Enabled Privileges:\s+(?\w+)\s+Disabled Privileges:" +| where privs="SeDebugPrivilege" +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Process_Name, privs, Process_ID, Message +| rename privs as "Enabled Privilege" +| rename Process_Name as process | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_mimikatz_via_powershell_and_eventcode_4703_filter` ====Associated Analytic Story==== @@ -7215,7 +7215,7 @@ The activity may be legitimate. PowerShell is often used by administrators to pe This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -7223,25 +7223,25 @@ This search will detect users creating spikes of API activity in your AWS enviro
====Search==== -`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApiCall -| spath output=arn path=userIdentity.arn -| stats count as apiCalls by arn -| inputlookup api_call_by_user_baseline append=t -| fields - latestCount -| stats values(*) as * by arn -| rename apiCalls as latestCount -| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 -| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) -| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) -| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls -| outputlookup api_call_by_user_baseline -| eval dataPointThreshold = 15, deviationThreshold = 3 -| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) -| where isSpike=1 -| rename arn as userIdentity.arn -| table userIdentity.arn] -| spath output=user userIdentity.arn -| stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user +`cloudtrail` eventType=AwsApiCall [search `cloudtrail` eventType=AwsApiCall +| spath output=arn path=userIdentity.arn +| stats count as apiCalls by arn +| inputlookup api_call_by_user_baseline append=t +| fields - latestCount +| stats values(*) as * by arn +| rename apiCalls as latestCount +| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 +| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) +| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup api_call_by_user_baseline +| eval dataPointThreshold = 15, deviationThreshold = 3 +| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) +| where isSpike=1 +| rename arn as userIdentity.arn +| table userIdentity.arn] +| spath output=user userIdentity.arn +| stats values(eventName) as eventName, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_aws_api_activity_filter` ====Associated Analytic Story==== @@ -7298,7 +7298,7 @@ Detailed documentation on how to create a new field within Incident Review may b This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007] * '''Last Updated''': 2018-05-21 @@ -7306,25 +7306,25 @@ This search will detect users creating spikes in API activity related to network
====Search==== -`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_events` -| spath output=arn path=userIdentity.arn -| stats count as apiCalls by arn -| inputlookup network_acl_activity_baseline append=t -| fields - latestCount -| stats values(*) as * by arn -| rename apiCalls as latestCount -| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 -| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) -| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) -| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls -| outputlookup network_acl_activity_baseline -| eval dataPointThreshold = 15, deviationThreshold = 3 -| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) -| where isSpike=1 -| rename arn as userIdentity.arn -| table userIdentity.arn] -| spath output=user userIdentity.arn -| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user +`cloudtrail` `network_acl_events` [search `cloudtrail` `network_acl_events` +| spath output=arn path=userIdentity.arn +| stats count as apiCalls by arn +| inputlookup network_acl_activity_baseline append=t +| fields - latestCount +| stats values(*) as * by arn +| rename apiCalls as latestCount +| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 +| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) +| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup network_acl_activity_baseline +| eval dataPointThreshold = 15, deviationThreshold = 3 +| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) +| where isSpike=1 +| rename arn as userIdentity.arn +| table userIdentity.arn] +| spath output=user userIdentity.arn +| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_network_acl_activity_filter` ====Associated Analytic Story==== @@ -7375,7 +7375,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2018-04-18 @@ -7383,25 +7383,25 @@ This search will detect users creating spikes in API activity related to securit
====Search==== -`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_group_api_calls` -| spath output=arn path=userIdentity.arn -| stats count as apiCalls by arn -| inputlookup security_group_activity_baseline append=t -| fields - latestCount -| stats values(*) as * by arn -| rename apiCalls as latestCount -| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 -| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) -| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) -| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls -| outputlookup security_group_activity_baseline -| eval dataPointThreshold = 15, deviationThreshold = 3 -| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) -| where isSpike=1 -| rename arn as userIdentity.arn -| table userIdentity.arn] -| spath output=user userIdentity.arn -| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user +`cloudtrail` `security_group_api_calls` [search `cloudtrail` `security_group_api_calls` +| spath output=arn path=userIdentity.arn +| stats count as apiCalls by arn +| inputlookup security_group_activity_baseline append=t +| fields - latestCount +| stats values(*) as * by arn +| rename apiCalls as latestCount +| eval newAvgApiCalls=avgApiCalls + (latestCount-avgApiCalls)/720 +| eval newStdevApiCalls=sqrt(((pow(stdevApiCalls, 2)*719 + (latestCount-newAvgApiCalls)*(latestCount-avgApiCalls))/720)) +| eval avgApiCalls=coalesce(newAvgApiCalls, avgApiCalls), stdevApiCalls=coalesce(newStdevApiCalls, stdevApiCalls), numDataPoints=if(isnull(latestCount), numDataPoints, numDataPoints+1) +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup security_group_activity_baseline +| eval dataPointThreshold = 15, deviationThreshold = 3 +| eval isSpike=if((latestCount > avgApiCalls+deviationThreshold*stdevApiCalls) AND numDataPoints > dataPointThreshold, 1, 0) +| where isSpike=1 +| rename arn as userIdentity.arn +| table userIdentity.arn] +| spath output=user userIdentity.arn +| stats values(eventName) as eventNames, count as numberOfApiCalls, dc(eventName) as uniqueApisCalled by user | `detect_spike_in_security_group_activity_filter` ====Associated Analytic Story==== @@ -7453,7 +7453,7 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change_Analysis -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-11-27
@@ -7461,10 +7461,10 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe ====Search==== -| tstats `security_content_summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest +| tstats `security_content_summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")` | `security_content_ctime(earliest)` -| `security_content_ctime(latest)` +| `security_content_ctime(latest)` | `detect_usb_device_insertion_filter` ====Associated Analytic Story==== @@ -7506,7 +7506,7 @@ Legitimate USB activity will also be detected. Please verify and investigate as This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2018-04-16 @@ -7514,20 +7514,20 @@ This search detects new API calls that have either never been seen before or tha
====Search==== -`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole [search `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole -| stats earliest(_time) as earliest latest(_time) as latest by userName eventName -| inputlookup append=t previously_seen_api_calls_from_user_roles -| stats min(earliest) as earliest, max(latest) as latest by userName eventName +`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole [search `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole +| stats earliest(_time) as earliest latest(_time) as latest by userName eventName +| inputlookup append=t previously_seen_api_calls_from_user_roles +| stats min(earliest) as earliest, max(latest) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles -| eval newApiCallfromUserRole=if(earliest>=relative_time(now(), "-70m@m"), 1, 0) -| where newApiCallfromUserRole=1 -| `security_content_ctime(earliest)` -| `security_content_ctime(latest)` -| table eventName userName] +| eval newApiCallfromUserRole=if(earliest>=relative_time(now(), "-70m@m"), 1, 0) +| where newApiCallfromUserRole=1 +| `security_content_ctime(earliest)` +| `security_content_ctime(latest)` +| table eventName userName] |rename userName as user -| stats values(eventName) earliest(_time) as earliest latest(_time) as latest by user -| `security_content_ctime(earliest)` -| `security_content_ctime(latest)` +| stats values(eventName) earliest(_time) as earliest latest(_time) as latest by user +| `security_content_ctime(earliest)` +| `security_content_ctime(latest)` | `detect_new_api_calls_from_user_roles_filter` ====Associated Analytic Story==== @@ -7576,7 +7576,7 @@ It is possible that there are legitimate user roles making new or infrequently u This search looks for CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -7584,15 +7584,15 @@ This search looks for CloudTrail events wherein a console login event by a user
====Search==== -`cloudtrail` eventName=ConsoleLogin -| rename userIdentity.arn as user -| stats earliest(_time) as firstTime latest(_time) as lastTime by user -| inputlookup append=t previously_seen_users_console_logins_cloudtrail -| stats min(firstTime) as firstTime max(lastTime) as lastTime by user -| eval userStatus=if(firstTime >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") +`cloudtrail` eventName=ConsoleLogin +| rename userIdentity.arn as user +| stats earliest(_time) as firstTime latest(_time) as lastTime by user +| inputlookup append=t previously_seen_users_console_logins_cloudtrail +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user +| eval userStatus=if(firstTime >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` -| where userStatus ="First Time Logging into AWS Console" +| where userStatus ="First Time Logging into AWS Console" | `detect_new_user_aws_console_login_filter` ====Associated Analytic Story==== @@ -7652,10 +7652,10 @@ This search looks for web connections to dynamic DNS providers. ====Search==== -| tstats `security_content_summariesonly` count values(Web.url) as url min(_time) as firstTime from datamodel=Web where Web.status=200 by Web.src Web.dest Web.status -| `drop_dm_object_name("Web")` -| `security_content_ctime(firstTime)` -| `dynamic_dns_web_traffic` +| tstats `security_content_summariesonly` count values(Web.url) as url min(_time) as firstTime from datamodel=Web where Web.status=200 by Web.src Web.dest Web.status +| `drop_dm_object_name("Web")` +| `security_content_ctime(firstTime)` +| `dynamic_dns_web_traffic` | `detect_web_traffic_to_dynamic_domain_providers_filter` ====Associated Analytic Story==== @@ -7719,17 +7719,17 @@ This search is used to detect DNS tunneling, by calculating the sum of the lengt ====Search==== -| tstats `security_content_summariesonly` dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.query" -| rename "DNS.src" as src "DNS.query" as message -| eval length=len(message) -| stats sum(length) as length by src -| append [ tstats `security_content_summariesonly` dc("DNS.answer") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.answer" -| rename "DNS.src" as src "DNS.answer" as message -| eval message=if(message=="unknown","", message) -| eval length=len(message) -| stats sum(length) as length by src ] -| stats sum(length) as length by src -| where length > 10000 +| tstats `security_content_summariesonly` dc("DNS.query") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.query" +| rename "DNS.src" as src "DNS.query" as message +| eval length=len(message) +| stats sum(length) as length by src +| append [ tstats `security_content_summariesonly` dc("DNS.answer") as count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" NOT (`cim_corporate_web_domain_search("DNS.query")`) NOT "DNS.query"="*.in-addr.arpa" NOT ("DNS.src_category"="svc_infra_dns" OR "DNS.src_category"="svc_infra_webproxy" OR "DNS.src_category"="svc_infra_email*" ) by "DNS.src","DNS.answer" +| rename "DNS.src" as src "DNS.answer" as message +| eval message=if(message=="unknown","", message) +| eval length=len(message) +| stats sum(length) as length by src ] +| stats sum(length) as length by src +| where length > 10000 | `detection_of_dns_tunnels_filter` ====Associated Analytic Story==== @@ -7786,7 +7786,7 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -7794,21 +7794,21 @@ This search looks for EC2 instances being modified by users who have not previou
====Search==== -`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_modification_api_calls` errorCode=success -| stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn -| rename userIdentity.arn as arn -| inputlookup append=t previously_seen_ec2_modifications_by_user -| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn -| outputlookup previously_seen_ec2_modifications_by_user -| eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newUser=1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rename arn as userIdentity.arn -| table userIdentity.arn] -| spath output=dest responseElements.instancesSet.items{}.instanceId -| spath output=user userIdentity.arn -| table _time, user, dest +`cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_modification_api_calls` errorCode=success +| stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn +| rename userIdentity.arn as arn +| inputlookup append=t previously_seen_ec2_modifications_by_user +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn +| outputlookup previously_seen_ec2_modifications_by_user +| eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newUser=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| rename arn as userIdentity.arn +| table userIdentity.arn] +| spath output=dest responseElements.instancesSet.items{}.instanceId +| spath output=user userIdentity.arn +| table _time, user, dest | `ec2_instance_modified_with_previously_unseen_user_filter` ====Associated Analytic Story==== @@ -7857,7 +7857,7 @@ It's possible that a new user will start to modify EC2 instances when they haven This search looks for CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1535/ T1535] * '''Last Updated''': 2018-02-23 @@ -7865,15 +7865,15 @@ This search looks for CloudTrail events where an instance is started in a partic
====Search==== -`cloudtrail` earliest=-1h StartInstances -| stats earliest(_time) as earliest latest(_time) as latest by awsRegion -| inputlookup append=t previously_seen_aws_regions.csv -| stats min(earliest) as earliest max(latest) as latest by awsRegion -| outputlookup previously_seen_aws_regions.csv -| eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region") -| `security_content_ctime(earliest)` -| `security_content_ctime(latest)` -| where regionStatus="Instance Started in a New Region" +`cloudtrail` earliest=-1h StartInstances +| stats earliest(_time) as earliest latest(_time) as latest by awsRegion +| inputlookup append=t previously_seen_aws_regions.csv +| stats min(earliest) as earliest max(latest) as latest by awsRegion +| outputlookup previously_seen_aws_regions.csv +| eval regionStatus=if(earliest >= relative_time(now(),"-1d@d"), "Instance Started in a New Region","Previously Seen Region") +| `security_content_ctime(earliest)` +| `security_content_ctime(latest)` +| where regionStatus="Instance Started in a New Region" | `ec2_instance_started_in_previously_unseen_region_filter` ====Associated Analytic Story==== @@ -7926,28 +7926,28 @@ It's possible that a user has unknowingly started an instance in a new region. P This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-03-12
====Search==== -`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success -| stats earliest(_time) as firstTime latest(_time) as lastTime by requestParameters.instancesSet.items{}.imageId -| rename requestParameters.instancesSet.items{}.imageId as amiID -| inputlookup append=t previously_seen_ec2_amis.csv -| stats min(firstTime) as firstTime max(lastTime) as lastTime by amiID -| outputlookup previously_seen_ec2_amis.csv -| eval newAMI=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success +| stats earliest(_time) as firstTime latest(_time) as lastTime by requestParameters.instancesSet.items{}.imageId +| rename requestParameters.instancesSet.items{}.imageId as amiID +| inputlookup append=t previously_seen_ec2_amis.csv +| stats min(firstTime) as firstTime max(lastTime) as lastTime by amiID +| outputlookup previously_seen_ec2_amis.csv +| eval newAMI=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` -| where newAMI=1 -| rename amiID as requestParameters.instancesSet.items{}.imageId -| table requestParameters.instancesSet.items{}.imageId] -| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as arn, requestParameters.instancesSet.items{}.imageId as amiID -| table firstTime, lastTime, arn, amiID, dest, instanceType +|`security_content_ctime(lastTime)` +| where newAMI=1 +| rename amiID as requestParameters.instancesSet.items{}.imageId +| table requestParameters.instancesSet.items{}.imageId] +| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as arn, requestParameters.instancesSet.items{}.imageId as amiID +| table firstTime, lastTime, arn, amiID, dest, instanceType | `ec2_instance_started_with_previously_unseen_ami_filter` ====Associated Analytic Story==== @@ -7985,30 +7985,30 @@ After a new AMI is created, the first systems created with that AMI will cause t This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-02-07
====Search==== -`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success -| fillnull value="m1.small" requestParameters.instanceType -| stats earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType -| rename requestParameters.instanceType as instanceType -| inputlookup append=t previously_seen_ec2_instance_types.csv -| stats min(earliest) as earliest max(latest) as latest by instanceType -| outputlookup previously_seen_ec2_instance_types.csv -| eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0) -| `security_content_ctime(earliest)` -| `security_content_ctime(latest)` -| where newType=1 -| rename instanceType as requestParameters.instanceType -| table requestParameters.instanceType] -| spath output=user userIdentity.arn -| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest -| table _time, user, dest, instanceType +`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success +| fillnull value="m1.small" requestParameters.instanceType +| stats earliest(_time) as earliest latest(_time) as latest by requestParameters.instanceType +| rename requestParameters.instanceType as instanceType +| inputlookup append=t previously_seen_ec2_instance_types.csv +| stats min(earliest) as earliest max(latest) as latest by instanceType +| outputlookup previously_seen_ec2_instance_types.csv +| eval newType=if(earliest >= relative_time(now(), "-70m@m"), 1, 0) +| `security_content_ctime(earliest)` +| `security_content_ctime(latest)` +| where newType=1 +| rename instanceType as requestParameters.instanceType +| table requestParameters.instanceType] +| spath output=user userIdentity.arn +| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest +| table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_instance_type_filter` ====Associated Analytic Story==== @@ -8046,7 +8046,7 @@ It is possible that an admin will create a new system using a new instance type This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2020-07-21 @@ -8054,20 +8054,20 @@ This search looks for EC2 instances being created by users who have not created
====Search==== -`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success -| stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn -| rename userIdentity.arn as arn -| inputlookup append=t previously_seen_ec2_launches_by_user.csv -| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn -| outputlookup previously_seen_ec2_launches_by_user.csv -| eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newUser=1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rename arn as userIdentity.arn -| table userIdentity.arn] -| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user -| table _time, user, dest, instanceType +`cloudtrail` eventName=RunInstances [search `cloudtrail` eventName=RunInstances errorCode=success +| stats earliest(_time) as firstTime latest(_time) as lastTime by userIdentity.arn +| rename userIdentity.arn as arn +| inputlookup append=t previously_seen_ec2_launches_by_user.csv +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by arn +| outputlookup previously_seen_ec2_launches_by_user.csv +| eval newUser=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newUser=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| rename arn as userIdentity.arn +| table userIdentity.arn] +| rename requestParameters.instanceType as instanceType, responseElements.instancesSet.items{}.instanceId as dest, userIdentity.arn as user +| table _time, user, dest, instanceType | `ec2_instance_started_with_previously_unseen_user_filter` ====Associated Analytic Story==== @@ -8127,10 +8127,10 @@ This search looks for processes launched from files with at least five spaces in ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_path) as process_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* .*" by Processes.dest Processes.user Processes.process Processes.process_name +| tstats `security_content_summariesonly` count values(Processes.process_path) as process_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* .*" by Processes.dest Processes.user Processes.process Processes.process_name | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` | `execution_of_file_with_spaces_before_extension_filter` ====Associated Analytic Story==== @@ -8181,21 +8181,21 @@ None identified. This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-12
====Search==== -`netbackup` MESSAGE="Disk/Partition backup completed successfully." -| stats latest(_time) as latestTime by COMPUTERNAME -| `security_content_ctime(latestTime)` -| rename COMPUTERNAME as dest -| eval isOutlier=if(latestTime <= relative_time(now(), "-7d@d"), 1, 0) -| search isOutlier=1 -| table latestTime, dest +`netbackup` MESSAGE="Disk/Partition backup completed successfully." +| stats latest(_time) as latestTime by COMPUTERNAME +| `security_content_ctime(latestTime)` +| rename COMPUTERNAME as dest +| eval isOutlier=if(latestTime <= relative_time(now(), "-7d@d"), 1, 0) +| search isOutlier=1 +| table latestTime, dest | `extended_period_without_successful_netbackup_backups_filter` ====Associated Analytic Story==== @@ -8244,19 +8244,19 @@ This search looks for command-line arguments that use a `/c` parameter to execut | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | search [ -| tstats `security_content_summariesonly` earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process -| `drop_dm_object_name(Processes)` -| inputlookup append=t previously_seen_cmd_line_arguments -| stats min(firstTime) as firstTime, max(lastTime) as lastTime by process -| outputlookup previously_seen_cmd_line_arguments -| eval newCmdLineArgument=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) -| where newCmdLineArgument=1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table process] +| tstats `security_content_summariesonly` earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = cmd.exe Processes.process = "* /c *" by Processes.process +| `drop_dm_object_name(Processes)` +| inputlookup append=t previously_seen_cmd_line_arguments +| stats min(firstTime) as firstTime, max(lastTime) as lastTime by process +| outputlookup previously_seen_cmd_line_arguments +| eval newCmdLineArgument=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0) +| where newCmdLineArgument=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table process] | `first_time_seen_command_line_argument_filter` ====Associated Analytic Story==== @@ -8321,7 +8321,7 @@ Legitimate programs can also use command-line arguments to execute. Please verif This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1525/ T1525] * '''Last Updated''': 2020-02-20 @@ -8330,8 +8330,8 @@ This search show information on uploaded containers including source user, accou ====Search==== -|tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Storage where Storage.event_name=storage.objects.create by Storage.src_user Storage.account Storage.action Storage.bucket_name Storage.event_name Storage.http_user_agent Storage.msg Storage.object_path -| `drop_dm_object_name("Storage")` +|tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Storage where Storage.event_name=storage.objects.create by Storage.src_user Storage.account Storage.action Storage.bucket_name Storage.event_name Storage.http_user_agent Storage.msg Storage.object_path +| `drop_dm_object_name("Storage")` | `gcp_gcr_container_uploaded_filter` ====Associated Analytic Story==== @@ -8380,7 +8380,7 @@ Uploading container is a normal behavior from developers or users with access to This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.002/ T1078.002] * '''Last Updated''': 2017-09-12 @@ -8389,12 +8389,12 @@ This detection search will help profile user accounts in your environment by ide ====Search==== -| from datamodel Identity_Management.All_Identities -| eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") +| from datamodel Identity_Management.All_Identities +| eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") | search empStatus="Accounts created in last week" -| `security_content_ctime(endDate)` +| `security_content_ctime(endDate)` | `security_content_ctime(startDate)` -| table identity empStatus endDate startDate +| table identity empStatus endDate startDate | `identify_new_user_accounts_filter` ====Associated Analytic Story==== @@ -8452,11 +8452,11 @@ This search looks for PowerShell processes started with a base64 encoded command ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* +| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter` ====Associated Analytic Story==== @@ -8510,7 +8510,7 @@ This search looks for DNS requests for faux domains similar to the domains that * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Resolution -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-23
@@ -8518,10 +8518,10 @@ This search looks for DNS requests for faux domains similar to the domains that ====Search==== -| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query -| `drop_dm_object_name("DNS")` +| tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query +| `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` -| `brand_abuse_dns` +| `brand_abuse_dns` | `monitor_dns_for_brand_abuse_filter` ====Associated Analytic Story==== @@ -8563,15 +8563,15 @@ None at this time This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-19
====Search==== -index=_internal sourcetype=splunk_web_access return_to="/%09/*" +index=_internal sourcetype=splunk_web_access return_to="/%09/*" | `open_redirect_in_splunk_web_filter` ====Associated Analytic Story==== @@ -8611,8 +8611,8 @@ None identified This search looks for ColdRoot events from the osx-attacks osquery pack. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2019-01-29
@@ -8620,11 +8620,11 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. ====Search==== -| from datamodel Alerts.Alerts -| search app=osquery:results (name=pack_osx-attacks_OSX_ColdRoot_RAT_Launchd OR name=pack_osx-attacks_OSX_ColdRoot_RAT_Files) -| rename columns.path as path -| bucket _time span=30s -| stats count(path) by _time, host, user, path +| from datamodel Alerts.Alerts +| search app=osquery:results (name=pack_osx-attacks_OSX_ColdRoot_RAT_Launchd OR name=pack_osx-attacks_OSX_ColdRoot_RAT_Files) +| rename columns.path as path +| bucket _time span=30s +| stats count(path) by _time, host, user, path | `osquery_pack___coldroot_detection_filter` ====Associated Analytic Story==== @@ -8675,10 +8675,10 @@ This search looks for processes launching netsh.exe to execute various commands ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe by Processes.user Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe by Processes.user Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `processes_created_by_netsh_filter` ====Associated Analytic Story==== @@ -8730,7 +8730,7 @@ This search looks for applications on the endpoint that you have marked as prohi * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2019-10-11
@@ -8738,11 +8738,11 @@ This search looks for applications on the endpoint that you have marked as prohi ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` -| `prohibited_softwares` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| `prohibited_softwares` | `prohibited_software_on_endpoint_filter` ====Associated Analytic Story==== @@ -8800,10 +8800,10 @@ The search looks for command-line arguments used to hide a file or directory usi ====Search==== | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = reg.exe Processes.process="*add*" Processes.process="*Hidden*" Processes.process="*REG_DWORD*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` -| regex process = "(/d\s+2)" +| regex process = "(/d\s+2)" | `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` ====Associated Analytic Story==== @@ -8858,8 +8858,8 @@ None at the moment This search monitors for remote modifications to registry keys. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-03-02
@@ -8867,10 +8867,10 @@ This search monitors for remote modifications to registry keys. ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` | `remote_registry_key_modifications_filter` ====Associated Analytic Story==== @@ -8923,10 +8923,10 @@ This search looks for wmic.exe being launched with parameters to operate on remo ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe AND Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe AND Processes.process= */node* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter` ====Associated Analytic Story==== @@ -8986,11 +8986,11 @@ This search looks for flags passed to schtasks.exe on the command-line that indi ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process= "*create*" OR Processes.process= "*delete*") by Processes.parent_process Processes.process_name Processes.user -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process= "*create*" OR Processes.process= "*delete*") by Processes.parent_process Processes.process_name Processes.user +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` -| search (process=*rhaegal* OR process=*drogon* OR *viserion_*) +|`security_content_ctime(lastTime)` +| search (process=*rhaegal* OR process=*drogon* OR *viserion_*) | `scheduled_tasks_used_in_badrabbit_ransomware_filter` ====Associated Analytic Story==== @@ -9041,20 +9041,20 @@ No known false positives This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-06-14
====Search==== -index=_internal sourcetype=splunkd_ui_access server-info -| search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" -| rename clientip as src_ip, splunk_server as dest -| stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +index=_internal sourcetype=splunkd_ui_access server-info +| search clientip!=127.0.0.1 uri_path="*raw/services/server/info/server-info" +| rename clientip as src_ip, splunk_server as dest +| stats earliest(_time) as firstTime, latest(_time) as lastTime, values(uri) as uri, values(useragent) as http_user_agent, values(user) as user by src_ip, dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `splunk_enterprise_information_disclosure_filter` ====Associated Analytic Story==== @@ -9094,7 +9094,7 @@ Retrieving server information may be a legitimate API request. Verify that the a This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.001/ T1546.001] * '''Last Updated''': 2020-07-22 @@ -9103,13 +9103,13 @@ This search looks for changes to registry values that control Windows file assoc ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name!=Explorer.exe AND Processes.process_name!=OpenWith.exe by Processes.process_id Processes.dest -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name!=Explorer.exe AND Processes.process_name!=OpenWith.exe by Processes.process_id Processes.dest +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | join [ -| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest -| `drop_dm_object_name("Registry")` +| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest +| `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `suspicious_changes_to_file_associations_filter` @@ -9163,8 +9163,8 @@ There may be other processes in your environment that users may legitimately use The search looks for files created with names that have been linked to malicious activity. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2019-04-25
@@ -9172,11 +9172,11 @@ The search looks for files created with names that have been linked to malicious ====Search==== -| tstats `security_content_summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Filesystem)` -| `suspicious_writes` +| tstats `security_content_summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Filesystem)` +| `suspicious_writes` | `suspicious_file_write_filter` ====Associated Analytic Story==== @@ -9216,7 +9216,7 @@ It's possible for a legitimate file to be created with the same name as one note This search detects writes to the 'System Volume Information' folder by something other than the System process. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036] * '''Last Updated''': 2020-07-22 @@ -9224,10 +9224,10 @@ This search detects writes to the 'System Volume Information' folder by somethin
====Search==== -(`sysmon` OR tag=process) EventCode=11 process_id!=4 file_path=*System\ Volume\ Information* -| stats count min(_time) as firstTime max(_time) as lastTime by dest, Image, file_path +(`sysmon` OR tag=process) EventCode=11 process_id!=4 file_path=*System\ Volume\ Information* +| stats count min(_time) as firstTime max(_time) as lastTime by dest, Image, file_path | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `suspicious_writes_to_system_volume_information_filter` ====Associated Analytic Story==== @@ -9285,11 +9285,11 @@ This search looks for applications on the endpoint that you have marked as uncom ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process Processes.process_name +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process Processes.process_name | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` -| `uncommon_processes` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| `uncommon_processes` |`uncommon_processes_on_endpoint_filter` ====Associated Analytic Story==== @@ -9344,7 +9344,7 @@ None identified This search detects loading of unsigned images by LSASS. Deprecated because too noisy. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-12-06 @@ -9352,11 +9352,11 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
====Search==== -`sysmon` EventID=7 Image=*lsass.exe Signed=false -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 -| rename Computer as dest +`sysmon` EventID=7 Image=*lsass.exe Signed=false +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 +| rename Computer as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_lsass_filter` ====Associated Analytic Story==== @@ -9409,20 +9409,20 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t This search gives you the hosts where a backup was attempted and then failed. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-12
====Search==== -`netbackup` -| stats latest(_time) as latestTime by COMPUTERNAME, MESSAGE -| search MESSAGE="An error occurred, failed to backup." -| `security_content_ctime(latestTime)` -| rename COMPUTERNAME as dest, MESSAGE as signature -| table latestTime, dest, signature +`netbackup` +| stats latest(_time) as latestTime by COMPUTERNAME, MESSAGE +| search MESSAGE="An error occurred, failed to backup." +| `security_content_ctime(latestTime)` +| rename COMPUTERNAME as dest, MESSAGE as signature +| table latestTime, dest, signature | `unsuccessful_netbackup_backups_filter` ====Associated Analytic Story==== @@ -9469,10 +9469,10 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" AND Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name -| `drop_dm_object_name(Registry)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" AND Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name +| `drop_dm_object_name(Registry)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter` ====Associated Analytic Story==== @@ -9520,10 +9520,10 @@ It is unusual to turn this feature on a Windows system since it is a default sec ---- ===Windows connhost exe started forcefully=== -The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. +The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. DEPRECATED This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.003/ T1059.003] * '''Last Updated''': 2020-11-06 @@ -9532,10 +9532,10 @@ The search looks for the Console Window Host process (connhost.exe) executed usi ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process="*C:\\Windows\\system32\\conhost.exe* 0xffffffff *-ForceV1*" by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process="*C:\\Windows\\system32\\conhost.exe* 0xffffffff *-ForceV1*" by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `windows_connhost_exe_started_forcefully_filter` ====Associated Analytic Story==== @@ -9586,8 +9586,8 @@ This process should not be ran forcefully, we have not see any false positives f The search looks for modifications to the hosts file on all Windows endpoints across your environment. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-11-02
@@ -9595,11 +9595,11 @@ The search looks for modifications to the hosts file on all Windows endpoints ac ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.file_path Filesystem.dest -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| search Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\* -| `drop_dm_object_name(Filesystem)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.file_path Filesystem.dest +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| search Filesystem.file_name=hosts AND Filesystem.file_path=*Windows\\System32\\* +| `drop_dm_object_name(Filesystem)` | `windows_hosts_file_modification_filter` ====Associated Analytic Story==== @@ -9644,7 +9644,7 @@ There may be legitimate reasons for system administrators to add entries to this Detect memory dumping of the LSASS process. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-12-06 @@ -9652,11 +9652,11 @@ Detect memory dumping of the LSASS process.
====Search==== -`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId -| rename Computer as dest +`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId +| rename Computer as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` ====Associated Analytic Story==== @@ -9711,7 +9711,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558] * '''Last Updated''': 2020-11-03 @@ -9722,10 +9722,10 @@ This detection indicates use of Mimikatz modules that facilitate Pass-the-Token | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -9826,7 +9826,7 @@ None identified. Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical accounts. This detection indicates such activities carried out by PowerSploit exploit kit APIs. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558] * '''Last Updated''': 2020-11-03 @@ -9837,10 +9837,10 @@ Stolen credentials are applied by methods such as user impersonation, credential | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -9939,7 +9939,7 @@ None identified. This detection identifies use of DSInternals modules that verify password strength, i.e., identify week accounts that would be easily compromised. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1555/ T1555] * '''Last Updated''': 2020-11-03 @@ -9950,10 +9950,10 @@ This detection identifies use of DSInternals modules that verify password streng | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -10041,10 +10041,10 @@ Attempt to add a certificate to the certificate store ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name Processes.user +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter` ====Associated Analytic Story==== @@ -10108,10 +10108,10 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +|`security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` ====Associated Analytic Story==== @@ -10177,12 +10177,12 @@ This search looks for attempts to stop security-related services on the endpoint ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -|lookup security_services_lookup service as process OUTPUTNEW category, description -| search category=security +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|lookup security_services_lookup service as process OUTPUTNEW category, description +| search category=security | `attempt_to_stop_security_service_filter` ====Associated Analytic Story==== @@ -10246,10 +10246,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` ====Associated Analytic Story==== @@ -10302,7 +10302,7 @@ None identified. Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-6-04 @@ -10310,13 +10310,13 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
====Search==== - -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) -| where process_name="cmd.exe" OR process_name="reg.exe" -| where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) +| where process_name="cmd.exe" OR process_name="reg.exe" +| where cmd_line != null AND match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -10388,10 +10388,10 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `bcdedit_failure_recovery_modification_filter` ====Associated Analytic Story==== @@ -10457,12 +10457,12 @@ The search looks for a batch file (.bat) written to the Windows system directory ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name values(Filesystem.user) as user from datamodel=Endpoint.Filesystem by Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` -| rex field=file_name "(?\.[^\.]+)$" -| search file_path=*system32* AND file_extension=.bat +| rex field=file_name "(?\.[^\.]+)$" +| search file_path=*system32* AND file_extension=.bat | `batch_file_write_to_system32_filter` ====Associated Analytic Story==== @@ -10516,7 +10516,7 @@ This search looks for arguments to certutil.exe indicating the manipulation or e * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2021-01-26
@@ -10524,10 +10524,10 @@ This search looks for arguments to certutil.exe indicating the manipulation or e ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` ====Associated Analytic Story==== @@ -10580,10 +10580,10 @@ This search looks for child processes of spoolsv.exe. This activity is associate ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe AND Processes.process_name!=regsvr32.exe by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `child_processes_of_spoolsv_exe_filter` ====Associated Analytic Story==== @@ -10643,12 +10643,12 @@ The search looks for file modifications with extensions commonly used by Ransomw ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` -| rex field=file_name "(?\.[^\.]+)$" -| `ransomware_extensions` +| rex field=file_name "(?\.[^\.]+)$" +| `ransomware_extensions` | `common_ransomware_extensions_filter` ====Associated Analytic Story==== @@ -10718,11 +10718,11 @@ The search looks for files created with names matching those typically used in r ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `ransomware_notes` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `ransomware_notes` | `common_ransomware_notes_filter` ====Associated Analytic Story==== @@ -10779,7 +10779,7 @@ It's possible that a legitimate file could be created with the same name used by Detect remote thread creation into LSASS consistent with credential dumping. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-12-06 @@ -10787,11 +10787,11 @@ Detect remote thread creation into LSASS consistent with credential dumping.
====Search==== -`sysmon` EventID=8 TargetImage=*lsass.exe -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId -| rename Computer as dest +`sysmon` EventID=8 TargetImage=*lsass.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId +| rename Computer as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter` ====Associated Analytic Story==== @@ -10855,10 +10855,10 @@ This search looks for the creation of local administrator accounts using net.exe ====Search==== -| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` ====Associated Analytic Story==== @@ -10924,11 +10924,11 @@ This search looks for the creation or deletion of hidden shares using net.exe. ====Search==== -| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| search process=*share* +| `security_content_ctime(lastTime)` +| search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` ====Associated Analytic Story==== @@ -10992,10 +10992,10 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe Processes.process=*shadowcopy* Processes.process=*create*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter` ====Associated Analytic Story==== @@ -11059,10 +11059,10 @@ This search detects the use of wmic and Powershell to create a shadow copy. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic* OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic* OR Processes.process_name=powershell* Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter` ====Associated Analytic Story==== @@ -11117,7 +11117,7 @@ Legtimate administrator usage of wmic to create a shadow copy. Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2020-02-03 @@ -11125,11 +11125,11 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess
====Search==== -`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename -| rename Computer as dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter` ====Associated Analytic Story==== @@ -11197,10 +11197,10 @@ This search detects credential dumping using copy command from a shadow copy. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process=*\\system32\\config\\sam* OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system* OR Processes.process=*\\windows\\ntds\\ntds.dit*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` ====Associated Analytic Story==== @@ -11264,10 +11264,10 @@ This search detects the creation of a symlink to a shadow copy. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` ====Associated Analytic Story==== @@ -11322,7 +11322,7 @@ unknown Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system's registry. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-18 @@ -11330,13 +11330,13 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) | where cmd_line != null AND process_name != null AND parent_process_name != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11399,7 +11399,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. FGdump is a newer version of pwdump tool that extracts NTLM and LanMan password hashes from Windows. Cachedump is a publicly-available tool that extracts cached password hashes from a system's registry. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-18 @@ -11407,13 +11407,13 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null) | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11474,7 +11474,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. LaZagne is a tool that extracts various kinds of credentials from a local computer, including account passwords, domain passwords, browser passwords, etc. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1555/ T1555] * '''Last Updated''': 2020-10-18 @@ -11482,13 +11482,13 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11549,7 +11549,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-21 @@ -11560,10 +11560,10 @@ Credential extraction is often an illegal recovery of credential material from s | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line, /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-UnicodePassword/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11628,7 +11628,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. DSInternals is a collection of PowerShell modules commonly employed in exploits. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-21 @@ -11639,10 +11639,10 @@ Credential extraction is often an illegal recovery of credential material from s | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line, /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line, /(?i)Get-SamPasswordPolicy/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11707,7 +11707,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Mimikatz is a collection of tools and modules commonly employed in Windows exploits. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-21 @@ -11718,10 +11718,10 @@ Credential extraction is often an illegal recovery of credential material from s | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11780,7 +11780,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit is a collection of Microsoft PowerShell modules commonly employed in exploits. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-21 @@ -11791,10 +11791,10 @@ Credential extraction is often an illegal recovery of credential material from s | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line, /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line, /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11853,7 +11853,7 @@ None identified. Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-18 @@ -11861,13 +11861,13 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name != null AND process_name != null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -11930,7 +11930,7 @@ Although unlikely, using debuggers this way may be indicative of developers anal Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. Native Microsoft debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential material directly from memory and process dumps. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-18 @@ -11938,13 +11938,13 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -12003,7 +12003,7 @@ Although unlikely, using debuggers this way may be indicative of developers anal Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve decryption or other transformations of the stored credential material. PowerSploit and DSInternals are common exploit APIs offering PowerShell modules for various exploits of Windows and Active Directory environments. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003/ T1003] * '''Last Updated''': 2020-10-18 @@ -12011,14 +12011,14 @@ Credential extraction is often an illegal recovery of credential material from s
====Search==== - + | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\ |]+/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -12084,10 +12084,10 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `deleting_shadow_copies_filter` ====Associated Analytic Story==== @@ -12144,7 +12144,7 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002] * '''Last Updated''': 2020-10-15 @@ -12152,11 +12152,11 @@ This search looks for specific authentication events from the Windows Security E
====Search==== -`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) -| fillnull -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest +`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) +| fillnull +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter` ====Associated Analytic Story==== @@ -12209,7 +12209,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea This search detects the heap-based buffer overflow of sudoedit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068] * '''Last Updated''': 2021-01-27 @@ -12217,8 +12217,8 @@ This search detects the heap-based buffer overflow of sudoedit
====Search==== -`linux_hosts` -| search "sudoedit -s \\" +`linux_hosts` +| search "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter` ====Associated Analytic Story==== @@ -12271,7 +12271,7 @@ unknown This search detects the heap-based buffer overflow of sudoedit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068] * '''Last Updated''': 2021-01-29 @@ -12279,10 +12279,10 @@ This search detects the heap-based buffer overflow of sudoedit
====Search==== -`linux_hosts` -| search sudoedit segfault -| stats count min(_time) as firstTime max(_time) as lastTime by host -| search count > 5 +`linux_hosts` +| search sudoedit segfault +| stats count min(_time) as firstTime max(_time) as lastTime by host +| search count > 5 | `detect_baron_samedit_cve_2021_3156_segfault_filter` ====Associated Analytic Story==== @@ -12335,7 +12335,7 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too. This search detects the heap-based buffer overflow of sudoedit * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068] * '''Last Updated''': 2021-01-28 @@ -12343,8 +12343,8 @@ This search detects the heap-based buffer overflow of sudoedit
====Search==== -`osquery_process` -| search "columns.cmdline"="sudoedit -s \\*" +`osquery_process` +| search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter` ====Associated Analytic Story==== @@ -12397,7 +12397,7 @@ unknown This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1210/ T1210] * '''Last Updated''': 2020-09-18 @@ -12405,8 +12405,8 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac
====Search==== -`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 -| stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user +`wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 +| stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user | `detect_computer_changed_with_anonymous_account_filter` ====Associated Analytic Story==== @@ -12459,7 +12459,7 @@ None thus far found This search looks for reading lsass memory consistent with credential dumping. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2019-12-03 @@ -12467,11 +12467,11 @@ This search looks for reading lsass memory consistent with credential dumping.
====Search==== -`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess -| rename Computer as dest +`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess +| rename Computer as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_credential_dumping_through_lsass_access_filter` ====Associated Analytic Story==== @@ -12526,7 +12526,7 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas This search detects the memory of lsass.exe being dumped for offline credential theft attack. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.003/ T1003.003] * '''Last Updated''': 2020-09-15 @@ -12535,10 +12535,10 @@ This search detects the memory of lsass.exe being dumped for offline credential ====Search==== -| from read_ssa_enriched_events() -| eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) -| where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body = "TBD" +| from read_ssa_enriched_events() +| eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) +| where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -12610,12 +12610,12 @@ This search identifies endpoints that have caused a relatively high number of ac ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest All_Changes.result -|`drop_dm_object_name("All_Changes")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest All_Changes.result +|`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| search count > 5 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter` ====Associated Analytic Story==== @@ -12681,12 +12681,12 @@ This search detects user accounts that have been locked out a relatively high nu ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result -|`drop_dm_object_name("All_Changes")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result +|`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| search count > 5 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search count > 5 | `detect_excessive_user_account_lockouts_filter` ====Associated Analytic Story==== @@ -12739,7 +12739,7 @@ It is possible that a legitimate user is experiencing an issue causing multiple The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type embedded, but only execute html/htm. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. Validate it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.001/ T1218.001] * '''Last Updated''': 2021-02-11 @@ -12747,11 +12747,11 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
====Search==== -`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=1 OriginalFileName=HH.exe NOT process_name=hh.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter` ====Associated Analytic Story==== @@ -12819,10 +12819,10 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter` ====Associated Analytic Story==== @@ -12894,10 +12894,10 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process=*http* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process=*http* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_html_help_url_in_command_line_filter` ====Associated Analytic Story==== @@ -12971,10 +12971,10 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter` ====Associated Analytic Story==== @@ -13039,7 +13039,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does This search detects a potential kerberoasting attack via service principal name requests * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1558.003/ T1558.003] * '''Last Updated''': 2020-10-21 @@ -13047,14 +13047,14 @@ This search detects a potential kerberoasting attack via service principal name
====Search==== - -| from read_ssa_enriched_events() -| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id") -| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" -| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] -| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID -| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" -| select start_time, end_time, entities, body + +| from read_ssa_enriched_events() +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event, "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"), ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event, "service_id") +| where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" +| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"] +| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -13126,10 +13126,10 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter` ====Associated Analytic Story==== @@ -13188,7 +13188,7 @@ It is possible legitimate applications may perform this behavior and will need t This search looks for newly created accounts that have been elevated to local administrators. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136.001/ T1136.001] * '''Last Updated''': 2020-07-08 @@ -13196,12 +13196,12 @@ This search looks for newly created accounts that have been elevated to local ad
====Search==== -`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) -| transaction member_id connected=false maxspan=180m -| rename member_id as user -| stats count min(_time) as firstTime max(_time) as lastTime by user dest +`wineventlog_security` EventCode=4720 OR (EventCode=4732 Group_Name=Administrators) +| transaction member_id connected=false maxspan=180m +| rename member_id as user +| stats count min(_time) as firstTime max(_time) as lastTime by user dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_new_local_admin_account_filter` ====Associated Analytic Story==== @@ -13260,7 +13260,7 @@ The activity may be legitimate. For this reason, it's best to verify the account This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1566.001/ T1566.001] * '''Last Updated''': 2020-07-21 @@ -13269,21 +13269,21 @@ This search looks for execution of process `outlook.exe` where the process is wr ====Search==== -| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | rename process_id as malicious_id | rename parent_process_id as outlook_id | join malicious_id type=inner[ -| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | rename process_id as malicious_id -| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] -| table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path -| where file_name != "" +| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] +| table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path +| where file_name != "" | `detect_oulook_exe_writing_a__zip_file_filter` ====Associated Analytic Story==== @@ -13336,7 +13336,7 @@ It is not uncommon for outlook to write legitimate zip files to the disk. This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002] * '''Last Updated''': 2020-10-21 @@ -13344,14 +13344,14 @@ This search looks for specific authentication events from the Windows Security E
====Search==== - -| from read_ssa_enriched_events() -| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact") -| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") -| first_time_event input_columns=["EventCode","LogonProcess","ComputerName"] -| where first_time_EventCode_LogonProcess_ComputerName -| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" -| select start_time, end_time, entities, body + +| from read_ssa_enriched_events() +| eval _time=map_get(input_event, "_time"), EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact") +| where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR (LogonType="9" AND LogonProcess="seclogo") +| first_time_event input_columns=["EventCode","LogonProcess","ComputerName"] +| where first_time_EventCode_LogonProcess_ComputerName +| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" +| select start_time, end_time, entities, body | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -13411,7 +13411,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea ---- ===Detect path interception by creation of program exe=== -The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. +The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -13423,17 +13423,17 @@ The detection Detect Path Interception By Creation Of program exe is detecting t ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest index -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest index +| `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe |bat |com -|ps1))" -| eval process_name = lower(process_name) -| eval service_process = lower(service_process) -| where process_name != service_process -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +|ps1))" +| eval process_name = lower(process_name) +| eval service_process = lower(service_process) +| where process_name != service_process +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` ====Associated Analytic Story==== @@ -13498,10 +13498,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a ====Search==== | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -|search [`prohibited_apps_launching_cmd`] +| `security_content_ctime(lastTime)` +|search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter` ====Associated Analytic Story==== @@ -13560,7 +13560,7 @@ There are circumstances where an application may legitimately execute and intera This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` by @bpatel. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059] * '''Last Updated''': 2020-7-13 @@ -13571,14 +13571,14 @@ This search looks for executions of cmd.exe spawned by a process that is often a | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval process_name=ucast(map_get(input_event, "process_name"), "string", null), parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) -| where process_name="cmd.exe" -| rex field=parent_process "(?[^\\\\]+)$" +| where process_name="cmd.exe" +| rex field=parent_process "(?[^\\\\]+)$" | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe" OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe" OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe" OR field0="java.exe" OR field0="powershell.exe" -| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body="TBD" +| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, dest_user_id), body="TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -13646,10 +13646,10 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` ====Associated Analytic Story==== @@ -13705,7 +13705,7 @@ This search will return a table of rare processes, the names of the systems runn * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-03-16
@@ -13713,17 +13713,17 @@ This search will return a table of rare processes, the names of the systems runn ====Search==== -| tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name -| rename Processes.process_name as process -| rex field=user "(?.*)\\\\(?.*)" +| tstats `security_content_summariesonly` count values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name +| rename Processes.process_name as process +| rex field=user "(?.*)\\\\(?.*)" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search [ -| tstats count from datamodel=Endpoint.Processes by Processes.process_name -| rare Processes.process_name limit=30 +| tstats count from datamodel=Endpoint.Processes by Processes.process_name +| rare Processes.process_name limit=30 | rename Processes.process_name as process | `filter_rare_process_allow_list` -| table process ] +| table process ] | `detect_rare_executables_filter` ====Associated Analytic Story==== @@ -13780,10 +13780,10 @@ The following analytic identifies regasm.exe spawning a process. This particular ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter` ====Associated Analytic Story==== @@ -13844,7 +13844,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.009/ T1218.009] * '''Last Updated''': 2021-02-16 @@ -13852,11 +13852,11 @@ The following analytic identifies regasm.exe with a network connection to a publ
====Search==== -`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe +| rename Computer as dest +| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter` ====Associated Analytic Story==== @@ -13915,7 +13915,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.009/ T1218.009] * '''Last Updated''': 2021-02-12 @@ -13923,12 +13923,12 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
====Search==== -`sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe) -| regex CommandLine="(regasm\.exe.{0,4}$)" -| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=1 (process_name=regasm.exe OR OriginalFileName=RegAsm.exe) +| regex CommandLine="(regasm\.exe.{0,4}$)" +| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regasm_with_no_command_line_arguments_filter` ====Associated Analytic Story==== @@ -13996,10 +13996,10 @@ The following analytic identifies regsvcs.exe spawning a process. This particula ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter` ====Associated Analytic Story==== @@ -14058,7 +14058,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. By contacting a remote command and control server, the adversary will have the ability to escalate privileges and complete the objectives. During investigation, identify and retrieve the content being loaded. Review parallel processes for additional suspicious behavior. Gather any other file modifications and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.009/ T1218.009] * '''Last Updated''': 2021-02-16 @@ -14066,11 +14066,11 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
====Search==== -`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe +| rename Computer as dest +| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter` ====Associated Analytic Story==== @@ -14129,7 +14129,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.009/ T1218.009] * '''Last Updated''': 2021-02-12 @@ -14137,12 +14137,12 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
====Search==== -`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe) -| regex CommandLine="(regsvcs\.exe.{0,4}$)" -| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvcs.exe) +| regex CommandLine="(regsvcs\.exe.{0,4}$)" +| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter` ====Associated Analytic Story==== @@ -14199,7 +14199,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. ===Detect regsvr32 application control bypass=== Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.This variation of the technique is often referred to as a "Squiblydoo" attack. \ -Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. +Upon investigating, look for network connections to remote destinations (internal or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll" is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon execution. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint @@ -14211,10 +14211,10 @@ Upon investigating, look for network connections to remote destinations (interna ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=regsvr32.exe OR Processes.process_name!=regsvr32.exe) Processes.process=*scrobj* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_regsvr32_application_control_bypass_filter` ====Associated Analytic Story==== @@ -14284,10 +14284,10 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` ====Associated Analytic Story==== @@ -14359,10 +14359,10 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` ====Associated Analytic Story==== @@ -14434,10 +14434,10 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` ====Associated Analytic Story==== @@ -14509,10 +14509,10 @@ The following analytic identifies "rundll32.exe" execution with inline protocol ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter` ====Associated Analytic Story==== @@ -14580,10 +14580,10 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name Processes.user Processes.dest -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count values(Processes.process) min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name Processes.user Processes.dest +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +|`security_content_ctime(lastTime)` | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter` ====Associated Analytic Story==== @@ -14647,10 +14647,10 @@ The following analytic identifies "mshta.exe" execution with inline protocol han ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter` ====Associated Analytic Story==== @@ -14709,7 +14709,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta binary. Further analysis should be performed to review the executed content and validation it is the real mshta. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.005/ T1218.005] * '''Last Updated''': 2021-01-20 @@ -14717,9 +14717,9 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
====Search==== -`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe) -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest +`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mshta_renamed_filter` @@ -14787,14 +14787,14 @@ This search looks for fast execution of processes used for system network config ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` -| search `system_network_configuration_discovery_tools` -| transaction dest connected=false maxpause=5m -|where eventcount>=5 -| table firstTime lastTime dest user process_name process parent_process eventcount +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| search `system_network_configuration_discovery_tools` +| transaction dest connected=false maxpause=5m +|where eventcount>=5 +| table firstTime lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter` ====Associated Analytic Story==== @@ -14860,10 +14860,10 @@ This search looks for specific command-line arguments that may indicate the exec ====Search==== -| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* /stext *" OR Processes.process="* /scomma *" ) by Processes.parent_process Processes.process_name Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* /stext *" OR Processes.process="* /scomma *" ) by Processes.parent_process Processes.process_name Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `detection_of_tools_built_by_nirsoft_filter` ====Associated Analytic Story==== @@ -14916,7 +14916,7 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002] * '''Last Updated''': 2020-11-18 @@ -14925,8 +14925,8 @@ The search looks for modifications to registry keys that control the enforcement ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA* Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action +| `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter` ====Associated Analytic Story==== @@ -14990,10 +14990,10 @@ Detect the usage of comsvcs.dll for dumping the lsass process. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*comsvcs.dll* Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter` ====Associated Analytic Story==== @@ -15062,10 +15062,10 @@ During triage, confirm this is procdump.exe executing. If it is the first time a ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=procdump.exe (Processes.process=*-ma* OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter` ====Associated Analytic Story==== @@ -15125,7 +15125,7 @@ Detect a renamed instance of procdump.exe dumping the lsass process. This query During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001] * '''Last Updated''': 2021-02-01 @@ -15133,11 +15133,11 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
====Search==== -`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* -| rename Computer as dest -| stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` OriginalFileName=procdump process_name!=procdump*.exe EventID=1 (CommandLine=*-ma* OR CommandLine=*-mm*) CommandLine=*lsass* +| rename Computer as dest +| stats count min(_time) as firstTime max(_time) as lastTime by dest, parent_process_name, process_name, OriginalFileName, CommandLine +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_rename_filter` ====Associated Analytic Story==== @@ -15205,10 +15205,10 @@ This search looks for processes launched from files that have double extensions ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by Processes.dest Processes.user Processes.process Processes.parent_process -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by Processes.dest Processes.user Processes.process Processes.parent_process +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter` ====Associated Analytic Story==== @@ -15262,7 +15262,7 @@ The search looks for file writes with extensions consistent with a SamSam ransom * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2018-12-14
@@ -15270,12 +15270,12 @@ The search looks for file writes with extensions consistent with a SamSam ransom ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` -| rex field=file_name "(?\.[^\.]+)$" -| search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml +| rex field=file_name "(?\.[^\.]+)$" +| search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml | `file_with_samsam_extension_filter` ====Associated Analytic Story==== @@ -15326,12 +15326,12 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no ====Search==== -| tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_id) as parent_process_id values(Processes.process_name) as process_name values(Processes.process) as process from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest -| `drop_dm_object_name(Processes)` -| lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen -| where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") -| `security_content_ctime(firstTime)` -| table firstTime dest, process_id, process_name, parent_process_id, parent_process_name +| tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_id) as parent_process_id values(Processes.process_name) as process_name values(Processes.process) as process from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest +| `drop_dm_object_name(Processes)` +| lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen +| where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") +| `security_content_ctime(firstTime)` +| table firstTime dest, process_id, process_name, parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter` ====Associated Analytic Story==== @@ -15384,7 +15384,7 @@ A new child process of zoom isn't malicious by that fact alone. Further investig This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002] * '''Last Updated''': 2020-07-21 @@ -15392,12 +15392,12 @@ This search looks for the first and last time a Windows service is seen running
====Search==== -`wineventlog_system` EventCode=7036 -| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" -| where state="running" -| lookup previously_seen_running_windows_services service as service OUTPUT firstTimeSeen -| where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), `previously_seen_windows_services_window`) -| table _time dest service +`wineventlog_system` EventCode=7036 +| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" +| where state="running" +| lookup previously_seen_running_windows_services service as service OUTPUT firstTimeSeen +| where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), `previously_seen_windows_services_window`) +| table _time dest service | `first_time_seen_running_windows_service_filter` ====Associated Analytic Story==== @@ -15454,7 +15454,7 @@ A previously unseen service is not necessarily malicious. Verify that the servic This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques// ], [https://attack.mitre.org/techniques/T1202/ T1202] * '''Last Updated''': 2021-2-1 @@ -15463,16 +15463,16 @@ This search looks for command-line arguments that use a `/c` parameter to execut ====Search==== -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line), cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/, "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s |$)+)/, "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s -|$)+)/, "\\PATH"), /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\d+/, "N") -| where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true -| select cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id -| first_time_event input_columns=["cmd_line_norm"] -| where first_time_cmd_line_norm -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" +|$)+)/, "\\PATH"), /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm, /\d+/, "N") +| where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true +| select cmd_line, cmd_line_norm, timestamp, dest_device_id, dest_user_id +| first_time_event input_columns=["cmd_line_norm"] +| where first_time_cmd_line_norm +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15505,9 +15505,9 @@ You must be populating the endpoint data model for SSA and specifically the proc | Command and Scripting Interpreter | Execution |- -| -| -| +| +| +| |- | T1202 | Indirect Command Execution @@ -15550,8 +15550,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h ====Search==== -| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user Processes.dest -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user Processes.dest +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `hiding_files_and_directories_with_attrib_exe_filter` @@ -15588,7 +15588,7 @@ You must be ingesting data that records process activity from your hosts to popu ====Known False Positives==== -Some applications and users may legitimately use attrib.exe to interact with the files. +Some applications and users may legitimately use attrib.exe to interact with the files. ====Reference==== @@ -15608,7 +15608,7 @@ Some applications and users may legitimately use attrib.exe to interact with the This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping into http and RDP sessions, etc. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563] * '''Last Updated''': 2020-11-09 @@ -15619,10 +15619,10 @@ This detection identifies access to PowerSploit modules that enable illegaly acc | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line, /(?i)Get-WebConfig/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15693,7 +15693,7 @@ None identified. This detection identifies access to PowerSploit modules that create accounts illegaly. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1585/ T1585] * '''Last Updated''': 2020-11-09 @@ -15704,10 +15704,10 @@ This detection identifies access to PowerSploit modules that create accounts ill | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15766,7 +15766,7 @@ None identified. This detection identifies access to PowerSploit modules that delete event logs. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1070/ T1070] * '''Last Updated''': 2020-11-09 @@ -15777,10 +15777,10 @@ This detection identifies access to PowerSploit modules that delete event logs. | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15839,7 +15839,7 @@ None identified. This detection identifies use of DSInternals modules that enable or disable accounts illegaly. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-09 @@ -15850,10 +15850,10 @@ This detection identifies use of DSInternals modules that enable or disable acco | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15916,7 +15916,7 @@ None identified. This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1207/ T1207], [https://attack.mitre.org/techniques/T1484/ T1484] * '''Last Updated''': 2020-11-09 @@ -15927,10 +15927,10 @@ This detection identifies use of DSInternals modules for illegal management of A | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -15997,7 +15997,7 @@ None identified. This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1207/ T1207], [https://attack.mitre.org/techniques/T1484/ T1484] * '''Last Updated''': 2020-11-09 @@ -16008,11 +16008,11 @@ This detection identifies access to PowerSploit modules that enable illegal mana | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16079,7 +16079,7 @@ None identified. This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent WMI, access to OS objects under desired identities. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2020-11-09 @@ -16090,10 +16090,10 @@ This detection identifies access to PowerSploit modules that illegaly elevate ge | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16160,7 +16160,7 @@ None identified. This detection identifies use of Mimikatz modules for illegal privilege elevation. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548] * '''Last Updated''': 2020-11-09 @@ -16171,10 +16171,10 @@ This detection identifies use of Mimikatz modules for illegal privilege elevatio | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16237,7 +16237,7 @@ None identified. This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569] * '''Last Updated''': 2020-11-09 @@ -16248,10 +16248,10 @@ This detection identifies use of Mimikatz modules for illegal control over servi | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true OR match_regex(cmd_line, /(?i)misc::memssp/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16318,7 +16318,7 @@ None identified. This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands, modifying access to service objects, etc. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569] * '''Last Updated''': 2020-11-09 @@ -16329,11 +16329,11 @@ This detection identifies access to PowerSploit modules that enable illegal cont | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line, /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line, /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line, /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16400,7 +16400,7 @@ None identified. This search detects a potential kerberoasting attack via service principal name requests * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1558.003/ T1558.003] * '''Last Updated''': 2020-10-16 @@ -16408,10 +16408,10 @@ This search detects a potential kerberoasting attack via service principal name
====Search==== -`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 -| stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +`wineventlog_security` EventCode=4769 Ticket_Options=0x40810000 Ticket_Encryption_Type=0x17 +| stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id, Ticket_Encryption_Type, Ticket_Options +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `kerberoasting_spn_request_with_rc4_encryption_filter` ====Associated Analytic Story==== @@ -16469,7 +16469,7 @@ This search looks for processes referencing the plist files that determine which * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-02-07
@@ -16477,10 +16477,10 @@ This search looks for processes referencing the plist files that determine which ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `macos___re_opened_applications_filter` ====Associated Analytic Story==== @@ -16529,10 +16529,10 @@ This search looks for PowerShell processes started with parameters to modify the ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" by Processes.user Processes.process_name Processes.parent_process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" by Processes.user Processes.process_name Processes.parent_process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter` ====Associated Analytic Story==== @@ -16598,10 +16598,10 @@ This search looks for PowerShell processes that have encoded the script within t ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter` ====Associated Analytic Story==== @@ -16667,10 +16667,10 @@ This search looks for PowerShell processes started with parameters used to bypas ====Search==== -| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter` ====Associated Analytic Story==== @@ -16734,12 +16734,12 @@ This search looks for PowerShell processes launched with arguments that have cha ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "'"))-1) -| `malicious_powershell_process_with_obfuscation_techniques_filter` +| eval num_obfuscation = (mvcount(split(process,"`"))-1) + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "'"))-1) +| `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation > 10 ====Associated Analytic Story==== @@ -16794,7 +16794,7 @@ These characters might be legitimately on the command-line, but it is not common This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1547.010/ T1547.010] * '''Last Updated''': 2020-11-23 @@ -16803,8 +16803,8 @@ This search looks for registry activity associated with modifications to the reg ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action +| `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter` ====Associated Analytic Story==== @@ -16859,7 +16859,7 @@ You will encounter noise from legitimate print-monitor registry entries. Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1053/ T1053] * '''Last Updated''': 2020-08-25 @@ -16867,16 +16867,16 @@ Attacker activity may compromise executing several LOLBAS applications in conjun
====Search==== - -| from read_ssa_enriched_events() -| eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| where process_name=="regsvcs.exe" OR process_name=="ftp.exe" OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" OR process_name=="msconfig.exe" -| stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) -| eval lolbas_counter=lolbas_counter*1.0 -| rename window_end as timestamp -| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L -| where label AND quantile>0.99 -| eval start_time = window_start, end_time = timestamp, entities = mvappend(device), body = "TBD" + +| from read_ssa_enriched_events() +| eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| where process_name=="regsvcs.exe" OR process_name=="ftp.exe" OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe" OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe" OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe" OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe" OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe" OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" OR process_name=="msconfig.exe" +| stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) +| eval lolbas_counter=lolbas_counter*1.0 +| rename window_end as timestamp +| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L +| where label AND quantile>0.99 +| eval start_time = window_start, end_time = timestamp, entities = mvappend(device), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -16947,10 +16947,10 @@ This search looks for the execution of `nltest.exe` with command-line arguments ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter` ====Associated Analytic Story==== @@ -17028,10 +17028,10 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter` ====Associated Analytic Story==== @@ -17101,10 +17101,10 @@ Microsoft Windows contains accessibility features that can be launched with a ke ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.file_name Filesystem.dest -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe* OR Filesystem.file_path=*\\Windows\\System32\\utilman.exe* OR Filesystem.file_path=*\\Windows\\System32\\osk.exe* OR Filesystem.file_path=*\\Windows\\System32\\Magnify.exe* OR Filesystem.file_path=*\\Windows\\System32\\Narrator.exe* OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*) by Filesystem.file_name Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter` ====Associated Analytic Story==== @@ -17157,7 +17157,7 @@ Microsoft may provide updates to these binaries. Verify that these changes do no This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-04 @@ -17168,10 +17168,10 @@ This detection identifies use of PowerSploit modules that facilitate access prob | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17234,7 +17234,7 @@ None identified. This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1566.002/ T1566.002] * '''Last Updated''': 2021-01-28 @@ -17243,17 +17243,17 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user -| `drop_dm_object_name(Filesystem)` -| rename process_id as lnk_pid +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user +| `drop_dm_object_name(Filesystem)` +| rename process_id as lnk_pid | join lnk_pid, _time [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process -| `drop_dm_object_name(Processes)` -| rename parent_process_id as lnk_pid -| fields _time lnk_pid process_id dest process_name process_path process] -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time span=1h Processes.parent_process_id Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process +| `drop_dm_object_name(Processes)` +| rename parent_process_id as lnk_pid +| fields _time lnk_pid process_id dest process_name process_path process] +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` ====Associated Analytic Story==== @@ -17312,7 +17312,7 @@ This detection should yield little or no false positive results. It is uncommon This search looks for processes launched via WMI. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1047/ T1047] * '''Last Updated''': 2020-03-16 @@ -17321,8 +17321,8 @@ This search looks for processes launched via WMI. ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` @@ -17377,8 +17377,8 @@ Although unlikely, administrators may use wmi to execute commands for legitimate This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2019-01-25
@@ -17386,11 +17386,11 @@ This search looks for processes in an MacOS system that is tapping keyboard even ====Search==== -| from datamodel Alerts.Alerts -| search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps +| from datamodel Alerts.Alerts +| search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps | rename columns.cmdline as cmd, columns.name as process_name, columns.pid as process_id -| dedup host,process_name -| table host,process_name, cmd, process_id +| dedup host,process_name +| table host,process_name, cmd, process_id | `processes_tapping_keyboard_events_filter` ====Associated Analytic Story==== @@ -17439,10 +17439,10 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.user Processes.dest -|`drop_dm_object_name("Processes")` -|`security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process) AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*netsh* by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.user Processes.dest +|`drop_dm_object_name("Processes")` +|`security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` |`processes_launching_netsh_filter` ====Associated Analytic Story==== @@ -17499,7 +17499,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child relationships. The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1072/ T1072] * '''Last Updated''': 2020-08-13 @@ -17508,18 +17508,18 @@ An attacker may use LOLBAS tools spawned from vulnerable applications not typica ====Search==== -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) -| where parent_process_name!=null -| select parent_process_name, process_name, timestamp, dest_device_id, dest_user_id -| conditional_anomaly conditional="parent_process_name" target="process_name" -| rename output as input -| where input < 1 -| adaptive_threshold algorithm="quantile" entity="parent_process_name" window=604800000L +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process, "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null) +| where parent_process_name!=null +| select parent_process_name, process_name, timestamp, dest_device_id, dest_user_id +| conditional_anomaly conditional="parent_process_name" target="process_name" +| rename output as input +| where input < 1 +| adaptive_threshold algorithm="quantile" entity="parent_process_name" window=604800000L | where label AND quantile<0.1 AND (process_name="powershell.exe" OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe" OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe" OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe" OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe" OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe" OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe" OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe" OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe" OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe" OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe" OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe" OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe" OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe" OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe" OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe" OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe" OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe" OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe" OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe" OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe" OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe" OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe") -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17591,7 +17591,7 @@ Some custom tools used by admins could be used rarely to launch remotely applica This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1484/ T1484] * '''Last Updated''': 2020-11-05 @@ -17602,10 +17602,10 @@ This detection identifies access to PowerSploit modules that discover accounts, | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line, /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line, /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line, /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line, /(?i)Get-LastLoggedOn/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17672,7 +17672,7 @@ None identified. This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1484/ T1484] * '''Last Updated''': 2020-11-05 @@ -17683,10 +17683,10 @@ This detection identifies use of Mimikatz modules for discovery of accounts and | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17753,7 +17753,7 @@ None identified. This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, AD sites and forests, and trust relations. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1199/ T1199], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1591/ T1591], [https://attack.mitre.org/techniques/T1595/ T1595] * '''Last Updated''': 2020-11-06 @@ -17764,10 +17764,10 @@ This detection identifies access to PowerSploit modules for reconnaissance and a | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line, /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17842,7 +17842,7 @@ None identified. This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1590/ T1590], [https://attack.mitre.org/techniques/T1087/ T1087] * '''Last Updated''': 2020-11-06 @@ -17853,10 +17853,10 @@ This detection identifies access to PowerSploit modules that discover computers, | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line, /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17923,7 +17923,7 @@ None identified. This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1592/ T1592] * '''Last Updated''': 2020-11-06 @@ -17934,10 +17934,10 @@ This detection identifies use of Mimikatz modules for discovery of computers and | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -17996,7 +17996,7 @@ None identified. This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, security packages and files. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1012/ T1012], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1057/ T1057], [https://attack.mitre.org/techniques/T1083/ T1083], [https://attack.mitre.org/techniques/T1518/ T1518], [https://attack.mitre.org/techniques/T1592.002/ T1592.002] * '''Last Updated''': 2020-11-06 @@ -18007,10 +18007,10 @@ This detection identifies access to PowerSploit modules that discover and access | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line, /(?i)Get-RegistryMountedDrive/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18097,7 +18097,7 @@ None identified. This detection identifies use of Mimikatz modules for discovery and access to services and processes. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1007/ T1007], [https://attack.mitre.org/techniques/T1046/ T1046], [https://attack.mitre.org/techniques/T1057/ T1057] * '''Last Updated''': 2020-11-06 @@ -18108,10 +18108,10 @@ This detection identifies use of Mimikatz modules for discovery and access to se | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18178,7 +18178,7 @@ None identified. This detection identifies use of Mimikatz modules for discovery and access to network shares. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] * '''Last Updated''': 2020-11-06 @@ -18189,10 +18189,10 @@ This detection identifies use of Mimikatz modules for discovery and access to ne | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)net::share/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18259,7 +18259,7 @@ None identified. This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] * '''Last Updated''': 2020-11-06 @@ -18270,10 +18270,10 @@ This detection identifies access to PowerSploit modules that discover and access | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line, /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18340,7 +18340,7 @@ None identified. This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, weak access control policies, landing paths for dropping malicious software or data to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities, as well as services and system files that can be compromised. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1574/ T1574] * '''Last Updated''': 2020-11-05 @@ -18351,10 +18351,10 @@ This detection identifies use of PowerSploit modules that discover opportunities | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line, /(?i)Get-UnquotedService/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18433,7 +18433,7 @@ None identified. This detection identifies access to PowerSploit modules for reconnaissance of connectivity. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1135/ T1135], [https://attack.mitre.org/techniques/T1039/ T1039] * '''Last Updated''': 2020-11-06 @@ -18444,10 +18444,10 @@ This detection identifies access to PowerSploit modules for reconnaissance of co | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18514,7 +18514,7 @@ None identified. This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1589.001/ T1589.001], [https://attack.mitre.org/techniques/T1590.001/ T1590.001], [https://attack.mitre.org/techniques/T1590.003/ T1590.003], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-03 @@ -18525,10 +18525,10 @@ This detection identifies reconnaissance of credential stores and use of CryptoA | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18607,7 +18607,7 @@ None identified. This detection identifies use of PowerSploit modules for assessment of presence of defensive tools. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1595.002/ T1595.002], [https://attack.mitre.org/techniques/T1592.002/ T1592.002] * '''Last Updated''': 2020-11-05 @@ -18618,10 +18618,10 @@ This detection identifies use of PowerSploit modules for assessment of presence | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18684,7 +18684,7 @@ None identified. This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-05 @@ -18695,10 +18695,10 @@ This detection identifies use of PowerSploit modules for assessment of privilege | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18765,7 +18765,7 @@ None identified. This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft Detours is an open source library for intercepting, monitoring and instrumenting binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing the in-memory code for target functions. The Detours package also contains utilities to attach arbitrary DLLs and data segments called payloads to any Win32 binary. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1574/ T1574] * '''Last Updated''': 2020-11-05 @@ -18776,10 +18776,10 @@ This detection identifies use of Mimikatz modules for discovery of process or se | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -18857,10 +18857,10 @@ The search looks for reg.exe modifying registry keys that define Windows service ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* by Processes.process_id Processes.dest Processes.process -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services* by Processes.process_id Processes.dest Processes.process +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `reg_exe_manipulating_windows_services_registry_keys_filter` ====Associated Analytic Story==== @@ -18915,7 +18915,7 @@ It is unusual for a service to be created or modified by directly manipulating t The search looks for modifications to registry keys that can be used to launch an application or service at system startup. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1547.001/ T1547.001] * '''Last Updated''': 2020-11-27 @@ -18924,10 +18924,10 @@ The search looks for modifications to registry keys that can be used to launch a ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) by Registry.dest Registry.user -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*currentversion\\run* OR Registry.registry_path=*currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=CurrentVersion\\Winlogon\\Shell* OR Registry.registry_path=*CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*currentversion\\policies\\explorer\\run* OR Registry.registry_path=*currentversion\\runservices* OR Registry.registry_path=*\\CurrentControlSet\\Control\\Lsa\\* OR Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*" OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*) by Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` | `registry_keys_used_for_persistence_filter` ====Associated Analytic Story==== @@ -18992,7 +18992,7 @@ There are many legitimate applications that must execute on system startup and w This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries to benign system binaries. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.012/ T1546.012] * '''Last Updated''': 2020-11-27 @@ -19001,10 +19001,10 @@ This search looks for modifications to registry keys that can be used to elevate ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag OR Registry.registry_key_name=Debugger) by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options*") AND (Registry.registry_key_name=GlobalFlag OR Registry.registry_key_name=Debugger) by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` | `registry_keys_used_for_privilege_escalation_filter` ====Associated Analytic Story==== @@ -19063,7 +19063,7 @@ There are many legitimate applications that must execute upon system startup and This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.011/ T1546.011] * '''Last Updated''': 2020-11-26 @@ -19072,10 +19072,10 @@ This search looks for registry activity associated with application compatibilit ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name(Registry)` +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name(Registry)` | `registry_keys_for_creating_shim_databases_filter` ====Associated Analytic Story==== @@ -19139,10 +19139,10 @@ This search looks for the remote desktop process mstsc.exe running on systems up ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user Processes.process +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*mstsc.exe AND Processes.dest_category!=common_rdp_source by Processes.dest Processes.user Processes.process | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name(Processes)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` | `remote_desktop_process_running_on_system_filter` ====Associated Analytic Story==== @@ -19204,10 +19204,10 @@ This search looks for wmic.exe being launched with parameters to spawn a process ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wmic.exe Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*" Processes.process="*create*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wmic.exe Processes.process="*/node*" Processes.process="*process*" Processes.process="*call*" Processes.process="*create*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter` ====Associated Analytic Story==== @@ -19271,10 +19271,10 @@ This search looks for executing scripts with rundll32. Adversaries may abuse run ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = rundll32.exe by Processes.process_name Processes.parent_process_name Processes.process Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = rundll32.exe by Processes.process_name Processes.parent_process_name Processes.process Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `rundll_loading_dll_by_ordinal_filter` ====Associated Analytic Story==== @@ -19327,7 +19327,7 @@ While not common, loading a DLL under %AppData% and calling a function by ordina The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1486/ T1486] * '''Last Updated''': 2020-11-06 @@ -19336,10 +19336,10 @@ The search looks for files that contain the key word *Ryuk* under any folder in ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter` ====Associated Analytic Story==== @@ -19401,10 +19401,10 @@ The search looks for a file named "test.txt" written to the windows system direc ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt by Filesystem.file_path -| `drop_dm_object_name(Filesystem)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name) as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt by Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `samsam_test_file_write_filter` ====Associated Analytic Story==== @@ -19466,10 +19466,10 @@ This search looks for arguments to sc.exe indicating the creation or modificatio ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* config *") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* config *") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter` ====Associated Analytic Story==== @@ -19541,10 +19541,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` ====Associated Analytic Story==== @@ -19608,10 +19608,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="* /S *") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="* /S *") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter` ====Associated Analytic Story==== @@ -19675,10 +19675,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter` ====Associated Analytic Story==== @@ -19733,7 +19733,7 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma This search looks for scripts launched via WMI. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1047/ T1047] * '''Last Updated''': 2020-03-16 @@ -19742,8 +19742,8 @@ This search looks for scripts launched via WMI. ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = "scrcons.exe" by Processes.user Processes.dest Processes.process_name +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` @@ -19798,7 +19798,7 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p This detection identifies illegal setting of credentials via DSInternals modules. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-03 @@ -19809,10 +19809,10 @@ This detection identifies illegal setting of credentials via DSInternals modules | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"), "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -19885,7 +19885,7 @@ None identified. This detection identifies illegal setting of credentials via Mimikatz modules. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-03 @@ -19896,10 +19896,10 @@ This detection identifies illegal setting of credentials via Mimikatz modules. | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -19966,7 +19966,7 @@ None identified. This detection identifies illegal setting of credentials via PowerSploit modules. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098] * '''Last Updated''': 2020-11-03 @@ -19977,10 +19977,10 @@ This detection identifies illegal setting of credentials via PowerSploit modules | from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true ) -| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -20047,7 +20047,7 @@ None identified. This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes the parameters passed, handles the operation itself, or redirects the operation elsewhere. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.011/ T1546.011] * '''Last Updated''': 2020-12-08 @@ -20056,10 +20056,10 @@ This search looks for shim database files being written to default directories. ====Search==== -| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.file_name Filesystem.dest -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -|`drop_dm_object_name(Filesystem)` +| tstats `security_content_summariesonly` count values(Filesystem.action) values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom* by Filesystem.file_name Filesystem.dest +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +|`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter` ====Associated Analytic Story==== @@ -20121,10 +20121,10 @@ This search detects the process execution and arguments required to silently cre ====Search==== -| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter` ====Associated Analytic Story==== @@ -20186,13 +20186,13 @@ This search detects accounts that were created and deleted in a short time perio ====Search==== -| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| `drop_dm_object_name("All_Changes")` -| search result_id = 4720 result_id=4726 -| transaction user connected=false maxspan=240m -| table firstTime lastTime count user dest result_id +| tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name("All_Changes")` +| search result_id = 4720 result_id=4726 +| transaction user connected=false maxspan=240m +| table firstTime lastTime count user dest result_id | `short_lived_windows_accounts_filter` ====Associated Analytic Story==== @@ -20256,13 +20256,13 @@ This search looks for process names that consist only of a single letter. ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, Processes.process, Processes.process_name -| `drop_dm_object_name(Processes)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` -| eval process_name_length = len(process_name), endExe = if(substr(process_name, -4) == ".exe", 1, 0) -| search process_name_length=5 AND endExe=1 -| table count, firstTime, lastTime, dest, user, process, process_name +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, Processes.process, Processes.process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| eval process_name_length = len(process_name), endExe = if(substr(process_name, -4) == ".exe", 1, 0) +| search process_name_length=5 AND endExe=1 +| table count, firstTime, lastTime, dest, user, process, process_name | `single_letter_process_on_endpoint_filter` ====Associated Analytic Story==== @@ -20315,8 +20315,8 @@ Single-letter executables are not always malicious. Investigate this activity wi The search looks for a sharp increase in the number of files written to a particular host * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-03-16
@@ -20324,12 +20324,12 @@ The search looks for a sharp increase in the number of files written to a partic ====Search==== -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.action=created by _time span=1h, Filesystem.dest -| `drop_dm_object_name(Filesystem)` -| eventstats max(_time) as maxtime -| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), count, null))) as "count" avg(eval(if(_time upperBound) AND num_data_samples >=20, 1, 0) -| search isOutlier=1 +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.action=created by _time span=1h, Filesystem.dest +| `drop_dm_object_name(Filesystem)` +| eventstats max(_time) as maxtime +| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), count, null))) as "count" avg(eval(if(_time upperBound) AND num_data_samples >=20, 1, 0) +| search isOutlier=1 | `spike_in_file_writes_filter` ====Associated Analytic Story==== @@ -20373,7 +20373,7 @@ It is important to understand that if you happen to install any new applications The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of avsvmcloud.com. This detections will correlate both events. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1203/ T1203] * '''Last Updated''': 2020-12-14 @@ -20381,13 +20381,13 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
====Search==== -(`sysmon` EventCode=7 ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll) OR (`sysmon` EventCode=22 QueryName=*avsvmcloud.com) -| eventstats dc(EventCode) AS dc_events -| where dc_events=2 -| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) AS ImageLoaded values(QueryName) AS QueryName by host -| rename host as dest +(`sysmon` EventCode=7 ImageLoaded=*SolarWinds.Orion.Core.BusinessLayer.dll) OR (`sysmon` EventCode=22 QueryName=*avsvmcloud.com) +| eventstats dc(EventCode) AS dc_events +| where dc_events=2 +| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) AS ImageLoaded values(QueryName) AS QueryName by host +| rename host as dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `sunburst_correlation_dll_and_network_event_filter` ====Associated Analytic Story==== @@ -20440,7 +20440,7 @@ unknown The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the code executed and what is executing a renamed instance of MSBuild. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1127.001/ T1127.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003] * '''Last Updated''': 2021-01-12 @@ -20448,9 +20448,9 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
====Search==== -`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe) -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest +`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_rename_filter` @@ -20524,10 +20524,10 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter` ====Associated Analytic Story==== @@ -20584,7 +20584,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1112/ T1112] * '''Last Updated''': 2020-07-22 @@ -20593,18 +20593,18 @@ This search looks for reg.exe being launched from a command prompt not started b ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process_id Processes.parent_process_id +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | search [ -| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id Processes.dest Processes.process_name -| `drop_dm_object_name("Processes")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rename parent_process_id as process_id +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.parent_process_name=cmd.exe Processes.process_name= reg.exe by Processes.parent_process_id Processes.dest Processes.process_name +| `drop_dm_object_name("Processes")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| rename parent_process_id as process_id |dedup process_id -| table process_id dest] +| table process_id dest] | `suspicious_reg_exe_process_filter` ====Associated Analytic Story==== @@ -20672,10 +20672,10 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=regsvr32.exe (Processes.process=*appdata* OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter` ====Associated Analytic Story==== @@ -20738,7 +20738,7 @@ Limited false positives with the query restricted to specified paths. Add more w The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, validate it is the legitimate rundll32.exe executing and what script content it is loading. This query relies on the OriginalFileName from Sysmon, or internal name from the PE meta data. Expand the query as needed by looking for specific command line arguments outlined in other analytics. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1036.003/ T1036.003] * '''Last Updated''': 2021-02-04 @@ -20746,9 +20746,9 @@ The following analytic identifies renamed instances of rundll32.exe executing. r
====Search==== -`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest +`sysmon` EventID=1 OriginalFileName=RUNDLL32.EXE NOT process_name=rundll32.exe +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_rundll32_rename_filter` @@ -20822,10 +20822,10 @@ The following analytic identifies rundll32.exe executing a DLL function name, St ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*start* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_rundll32_startw_filter` ====Associated Analytic Story==== @@ -20899,10 +20899,10 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*dllregisterserver* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_rundll32_dllregisterserver_filter` ====Associated Analytic Story==== @@ -20969,7 +20969,7 @@ This is likely to produce false positives and will require some filtering. Tune The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1218.011/ T1218.011] * '''Last Updated''': 2021-02-09 @@ -20977,12 +20977,12 @@ The following analytic identifies rundll32.exe with no command line arguments. I
====Search==== -`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE) -| regex CommandLine="(rundll32\.exe.{0,4}$)" -| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`sysmon` EventID=1 (process_name=rundll32.exe OR OriginalFileName=RUNDLL32.EXE) +| regex CommandLine="(rundll32\.exe.{0,4}$)" +| stats count min(_time) as firstTime max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_rundll32_no_commandline_arguments_filter` ====Associated Analytic Story==== @@ -21045,7 +21045,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and review. A spawned child process from microsoft.workflow.compiler.exe is uncommon. In any instance, microsoft.workflow.compiler.exe spawning from an Office product or any living off the land binary is highly suspect. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1127/ T1127], [https://attack.mitre.org/techniques/T1036.003/ T1036.003] * '''Last Updated''': 2021-01-12 @@ -21053,9 +21053,9 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
====Search==== -`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe) -| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine -| rename Computer as dest +`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe) +| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine +| rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_rename_filter` @@ -21127,10 +21127,10 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter` ====Associated Analytic Story==== @@ -21196,9 +21196,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*) by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*) by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_msbuild_path_filter` @@ -21269,10 +21269,10 @@ The following analytic identifies child processes spawning from "mshta.exe". Th ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_mshta_child_process_filter` ====Associated Analytic Story==== @@ -21338,10 +21338,10 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe by Processes.dest Processes.parent_process Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe by Processes.dest Processes.parent_process Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter` ====Associated Analytic Story==== @@ -21410,9 +21410,9 @@ The wevtutil.exe application is the windows event log utility. This searches for ====Search==== | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = wevtutil.exe Processes.process="*cl*" (Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter` ====Associated Analytic Story==== @@ -21467,7 +21467,7 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ This search detects writes to the recycle bin by a process other than explorer.exe. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036] * '''Last Updated''': 2020-07-22 @@ -21476,12 +21476,12 @@ This search detects writes to the recycle bin by a process other than explorer.e ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" by Filesystem.process_id Filesystem.dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*" by Filesystem.process_id Filesystem.dest | `drop_dm_object_name("Filesystem")` | search [ | tstats `security_content_summariesonly` values(Processes.user) as user values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name != "explorer.exe" by Processes.process_id Processes.dest -| `drop_dm_object_name("Processes")` -| table process_id dest] +| `drop_dm_object_name("Processes")` +| table process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter` ====Associated Analytic Story==== @@ -21541,13 +21541,13 @@ Detect system information discovery techniques used by attackers to understand c ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user Processes.process_name Processes.process Processes.dest -| `drop_dm_object_name(Processes)` -| eventstats dc(process) as dc_processes_by_dest by dest -| where dc_processes_by_dest > 2 -| stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime by user, dest +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user Processes.process_name Processes.process Processes.dest +| `drop_dm_object_name(Processes)` +| eventstats dc(process) as dc_processes_by_dest by dest +| where dc_processes_by_dest > 2 +| stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime by user, dest | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter` ====Associated Analytic Story==== @@ -21602,7 +21602,7 @@ Administrators debugging servers An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the process from a different folder. This detection checks that a list of system processes run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml * '''Product''': UEBA for Security Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1036/ T1036] * '''Last Updated''': 2020-08-25 @@ -21610,36 +21610,36 @@ An attacker tries might try to use different version of a system command without
====Search==== - $ssa_input = -| from read_ssa_enriched_events() + $ssa_input = +| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)); -$cond_1 = -| from $ssa_input +$cond_1 = +| from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe" OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe" OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe" OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe" OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe" OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe" OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe" OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe" OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe" OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe" OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe" OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe" OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe" OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe" OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe" OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe" OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe" OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe" OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe" OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe" OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe" OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe" OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe" OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe" OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe" OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe" OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe" OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe" OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe" OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe" OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe" OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe"; -$cond_2 = -| from $ssa_input +$cond_2 = +| from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe" OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe" OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe" OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe" OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe" OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe" OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe" OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe" OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe" OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe" OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe" OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe" OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe" OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe" OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe" OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe" OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe" OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe" OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe" OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe" OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe" OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe" OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe" OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe" OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe" OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe" OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe" OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe" OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe" OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe" OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe" OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe" OR process_name="windowsanytimeupgraderesults.exe"; -$cond_3 = -| from $ssa_input +$cond_3 = +| from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe" OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe" OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe" OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe" OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe" OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe" OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe" OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe" OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe" OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe" OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe" OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe" OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe" OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe" OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe" OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe" OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe" OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe" OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe" OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe" OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe" OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe" OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe" OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe" OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe" OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe" OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe" OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe" OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe" OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe" OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe" OR process_name="easinvoker.exe" OR process_name="efsui.exe"; -$cond_4 = -| from $ssa_input +$cond_4 = +| from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe" OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe" OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe" OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe" OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe" OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe" OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe" OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe" OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe" OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe" OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe" OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe" OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe" OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe" OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe" OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe" OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe" OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe" OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe" OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe" OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe" OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe" OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe" OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe" OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe" OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe" OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe" OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe" OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe" OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe"; -$cond_5 = -| from $ssa_input +$cond_5 = +| from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe" OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe" OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe" OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe" OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe" OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe" OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe" OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe" OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe" OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe" OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe" OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe" OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe" OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe" OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe" OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe" OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe" OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe" OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe" OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe" OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe" OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe" OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe" OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe" OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe" OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe" OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe" OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe" OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe" OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe" OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe" OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe"; -$cond_6 = -| from $ssa_input +$cond_6 = +| from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe" OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe" OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe" OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe" OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe" OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe" OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe" OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe" OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe" OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe" OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe" OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe" OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe" OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe" OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe" OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe" OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe" OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe" OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe" OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe"; -| from $cond_1 -| union $cond_2 -| union $cond_3 -| union $cond_4 -| union $cond_5 -| union $cond_6 -| where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64" -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(device, user), body = "TBD" +| from $cond_1 +| union $cond_2 +| union $cond_3 +| union $cond_4 +| union $cond_5 +| union $cond_6 +| where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64" +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(device, user), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -21698,7 +21698,7 @@ None This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location. This can indicate a malicious process that is trying to hide as a legitimate process. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.003/ T1036.003] * '''Last Updated''': 2020-12-08 @@ -21708,10 +21708,10 @@ This search looks for system processes that normally run out of C:\Windows\Syste ====Search==== | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash -| `drop_dm_object_name("Processes")` +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| `is_windows_system_file` +| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter` ====Associated Analytic Story==== @@ -21777,11 +21777,11 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks ====Search==== -| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| search process="*deletejournal*" AND process="*usn*" +| `security_content_ctime(lastTime)` +| search process="*deletejournal*" AND process="*usn*" | `usn_journal_deletion_filter` ====Associated Analytic Story==== @@ -21845,10 +21845,10 @@ Attackers often disable security tools to avoid detection. This search looks for ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe AND Processes.process=*unload* AND Processes.process=*SysmonDrv* by Processes.process_name Processes.process_id Processes.parent_process_name Processes.process Processes.dest Processes.user -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe AND Processes.process=*unload* AND Processes.process=*SysmonDrv* by Processes.process_name Processes.process_id Processes.parent_process_name Processes.process Processes.dest Processes.user +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +|`security_content_ctime(lastTime)` |`unload_sysmon_filter_driver_filter` | table firstTime lastTime dest user count process_name process_id parent_process_name process @@ -21902,27 +21902,27 @@ You must be ingesting data that records process activity from your hosts to popu Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin to help identify command lines with lengths that are unusual for a given user. This detection is inspired on Unusually Long Command Line authored by Rico Valdez. * '''Product''': UEBA for Security Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-10-06
====Search==== - -| from read_ssa_enriched_events() -| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) -| eval cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) -| where cmd_line!=null and dest_user_id!=null + +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=ucast(map_get(input_event, "process_name"), "string", null) +| where cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+) -|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, ""))) -| select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, input -| adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 -| where label AND quantile>0.99 -| first_time_event input_columns=["dest_device_id", "cmd_line"] -| where first_time_dest_device_id_cmd_line -| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" +|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm, ""))) +| select timestamp, process_name, dest_device_id, dest_user_id, cmd_line, input +| adaptive_threshold algorithm="quantile" entity="process_name" window=60480000 +| where label AND quantile>0.99 +| first_time_event input_columns=["dest_device_id", "cmd_line"] +| where first_time_dest_device_id_cmd_line +| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body = "TBD" | into write_ssa_detected_events(); ====Associated Analytic Story==== @@ -21970,8 +21970,8 @@ This detection may flag suspiciously long command lines when there is not suffic Command lines that are extremely long may be indicative of malicious activity on your hosts. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2020-12-08
@@ -21979,15 +21979,15 @@ Command lines that are extremely long may be indicative of malicious activity on ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process -| `drop_dm_object_name("Processes")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process +| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| eval processlen=len(process) -| eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest -| stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process -| `unusually_long_command_line_filter` -|eval threshold = 3 +| eval processlen=len(process) +| eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest +| stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process +| `unusually_long_command_line_filter` +|eval threshold = 3 | where maxlen > ((threshold*stdevperhost) + avgperhost) ====Associated Analytic Story==== @@ -22035,8 +22035,8 @@ Some legitimate applications start with long command lines. Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2019-05-08
@@ -22044,16 +22044,16 @@ Command lines that are extremely long may be indicative of malicious activity on ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process -| `drop_dm_object_name(Processes)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process +| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` -| eval processlen=len(process) -| search user!=unknown -| apply cmdline_pdfmodel threshold=0.01 -| rename "IsOutlier(processlen)" as isOutlier -| search isOutlier > 0 -| table firstTime lastTime user dest process_name process processlen count +| eval processlen=len(process) +| search user!=unknown +| apply cmdline_pdfmodel threshold=0.01 +| rename "IsOutlier(processlen)" as isOutlier +| search isOutlier > 0 +| table firstTime lastTime user dest process_name process processlen count | `unusually_long_command_line___mltk_filter` ====Associated Analytic Story==== @@ -22108,9 +22108,9 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*") by Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.user +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wbadmin_delete_system_backups_filter` @@ -22174,7 +22174,7 @@ Administrators may modify the boot configuration. This search looks for the creation of WMI permanent event subscriptions. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1047/ T1047] * '''Last Updated''': 2018-10-23 @@ -22182,14 +22182,14 @@ This search looks for the creation of WMI permanent event subscriptions.
====Search==== -`wmi` EventCode=5861 Binding +`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?[^; -|^$]+)" -| search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" -| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, consumer, Message +|^$]+)" +| search consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\"" +| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, consumer, Message | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| rename ComputerName as dest +| `security_content_ctime(lastTime)` +| rename ComputerName as dest | `wmi_permanent_event_subscription_filter` ====Associated Analytic Story==== @@ -22240,7 +22240,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur This search looks for the creation of WMI permanent event subscriptions. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1546.003/ T1546.003] * '''Last Updated''': 2020-12-08 @@ -22248,9 +22248,9 @@ This search looks for the creation of WMI permanent event subscriptions.
====Search==== -`sysmon` EventCode=21 -| rename host as dest -| table _time, dest, user, Operation, EventType, Query, Consumer, Filter +`sysmon` EventCode=21 +| rename host as dest +| table _time, dest, user, Operation, EventType, Query, Consumer, Filter | `wmi_permanent_event_subscription___sysmon_filter` ====Associated Analytic Story==== @@ -22303,7 +22303,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur This search looks for the creation of WMI temporary event subscriptions. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1047/ T1047] * '''Last Updated''': 2018-10-23 @@ -22311,13 +22311,13 @@ This search looks for the creation of WMI temporary event subscriptions.
====Search==== -`wmi` EventCode=5860 Temporary +`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^; -|^$]+)" -| search query!="SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'" AND query!="SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" -| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, query +|^$]+)" +| search query!="SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'" AND query!="SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" +| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, query | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `wmi_temporary_event_subscription_filter` ====Associated Analytic Story==== @@ -22376,11 +22376,11 @@ This search looks for the execution of `adfind.exe` with command-line arguments
====Search==== - -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process=*-f* OR Processes.process=*-b*) AND (Processes.process=*objectcategory* OR Processes.process=*-gcb* OR Processes.process=*-sc*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process=*-f* OR Processes.process=*-b*) AND (Processes.process=*objectcategory* OR Processes.process=*-gcb* OR Processes.process=*-sc*) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `windows_adfind_exe_filter` ====Associated Analytic Story==== @@ -22437,7 +22437,7 @@ administrators rarely use adfind, usually not used for legitimate reasons This search looks for Windows events that indicate one of the Windows event logs has been purged. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1070.001/ T1070.001] * '''Last Updated''': 2020-07-06 @@ -22445,10 +22445,10 @@ This search looks for Windows events that indicate one of the Windows event logs
====Search==== -(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104) -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +(`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104) +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter` ====Associated Analytic Story==== @@ -22505,7 +22505,7 @@ It is possible that these logs may be legitimately cleared by Administrators. The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1489/ T1489] * '''Last Updated''': 2020-11-06 @@ -22514,10 +22514,10 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" -| `drop_dm_object_name(Processes)` -| `security_content_ctime(lastTime)` -| `security_content_ctime(firstTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" +| `drop_dm_object_name(Processes)` +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` | `windows_security_account_manager_stopped_filter` ====Associated Analytic Story==== @@ -22584,17 +22584,17 @@ This search allows you to identify DNS requests that are unusually large for the ====Search==== -| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution by DNS.query DNS.record_type -| search DNS.record_type=* -| `drop_dm_object_name(DNS)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| eval query_length = len(query) -| apply dns_query_pdfmodel threshold=0.01 -| rename "IsOutlier(query_length)" as isOutlier -| search isOutlier > 0 -| sort -query_length -| table start_time end_time query record_type count src dest query_length +| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time values(DNS.src) as src values(DNS.dest) as dest from datamodel=Network_Resolution by DNS.query DNS.record_type +| search DNS.record_type=* +| `drop_dm_object_name(DNS)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| eval query_length = len(query) +| apply dns_query_pdfmodel threshold=0.01 +| rename "IsOutlier(query_length)" as isOutlier +| search isOutlier > 0 +| sort -query_length +| table start_time end_time query record_type count src dest query_length | `dns_query_length_outliers___mltk_filter` ====Associated Analytic Story==== @@ -22664,13 +22664,13 @@ This search allows you to identify DNS requests and compute the standard deviati ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query -| `drop_dm_object_name("DNS")` -| eval query_length = len(query) -| table query query_length record_type count +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query +| `drop_dm_object_name("DNS")` +| eval query_length = len(query) +| table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50 -| where query_length>(avg+stdev*2) -| eval z_score=(query_length-avg)/stdev +| where query_length>(avg+stdev*2) +| eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` ====Associated Analytic Story==== @@ -22736,23 +22736,23 @@ The search takes the DNS records and their answers results of the discovered_dns ====Search==== -| inputlookup discovered_dns_records -| rename answer as discovered_answer +| inputlookup discovered_dns_records +| rename answer as discovered_answer | join domain[ -|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query -| rename DNS.query as query -| where query!="unknown" +|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query +| rename DNS.query as query +| where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$ -|/)"] -| makemv delim=" " answer -| makemv delim=" " type -| sort -count -| table count,src,domain,type,query,current_answer,discovered_answer -| makemv current_answer -| mvexpand current_answer -| makemv discovered_answer -| eval n=mvfind(discovered_answer, current_answer) -| where isnull(n) +|/)"] +| makemv delim=" " answer +| makemv delim=" " type +| sort -count +| table count,src,domain,type,query,current_answer,discovered_answer +| makemv current_answer +| mvexpand current_answer +| makemv discovered_answer +| eval n=mvfind(discovered_answer, current_answer) +| where isnull(n) | `dns_record_changed_filter` ====Associated Analytic Story==== @@ -22807,7 +22807,7 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557.002/ T1557.002] * '''Last Updated''': 2020-08-11 @@ -22815,9 +22815,9 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
====Search==== -`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" -| eval src_interface=src_int_prefix_long+src_int_suffix -| stats min(_time) AS firstTime max(_time) AS lastTime count BY host src_interface +`cisco_networks` facility="PM" mnemonic="ERR_DISABLE" disable_cause="arp-inspection" +| eval src_interface=src_int_prefix_long+src_int_suffix +| stats min(_time) AS firstTime max(_time) AS lastTime count BY host src_interface | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `detect_arp_poisoning_filter` @@ -22882,7 +22882,7 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557.002/ T1557.002] * '''Last Updated''': 2020-10-28 @@ -22890,13 +22890,13 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
====Search==== -`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") -| eval src_interface=src_int_prefix_long+src_int_suffix -| eval dest_interface=dest_int_prefix_long+dest_int_suffix -| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface -| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count -| `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +`cisco_networks` facility="SISF" mnemonic IN ("IP_THEFT","MAC_THEFT","MAC_AND_IP_THEFT","PAK_DROP") +| eval src_interface=src_int_prefix_long+src_int_suffix +| eval dest_interface=dest_int_prefix_long+dest_int_suffix +| stats min(_time) AS firstTime max(_time) AS lastTime values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(mnemonic) AS mnemonic values(vendor_explanation) AS vendor_explanation values(src_ip) AS src_ip values(dest_ip) AS dest_ip values(dest_interface) AS dest_interface values(action) AS action count BY host src_interface +| table host src_interface dest_interface src_mac src_ip dest_ip src_vlan mnemonic vendor_explanation action count +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` | `detect_ipv6_network_infrastructure_threats_filter` ====Associated Analytic Story==== @@ -22984,11 +22984,11 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 ====Search==== -| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) values(All_Traffic.bytes) from datamodel=Network_Traffic where All_Traffic.action !=blocked All_Traffic.dest_category !=internal (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) All_Traffic.bytes > 1000 by All_Traffic.src_ip All_Traffic.dest_ip -| `drop_dm_object_name("All_Traffic")` -| search ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) +| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) values(All_Traffic.bytes) from datamodel=Network_Traffic where All_Traffic.action !=blocked All_Traffic.dest_category !=internal (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) All_Traffic.bytes > 1000 by All_Traffic.src_ip All_Traffic.dest_ip +| `drop_dm_object_name("All_Traffic")` +| search ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +|`security_content_ctime(lastTime)` | `detect_large_outbound_icmp_packets_filter` ====Associated Analytic Story==== @@ -23048,10 +23048,10 @@ This search looks for outbound SMB connections made by hosts within your network ====Search==== -| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dest_port) as dest_port values(sourcetype) as sourcetype count from datamodel=Network_Traffic where ((All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb") AND NOT (All_Traffic.action="blocked" OR All_Traffic.dest_category="internal" OR All_Traffic.dest_ip=10.0.0.0/8 OR All_Traffic.dest_ip=172.16.0.0/12 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip=100.64.0.0/10)) by All_Traffic.src_ip -| `drop_dm_object_name("All_Traffic")` -| `security_content_ctime(start_time)` -| `security_content_ctime(end_time)` +| tstats `security_content_summariesonly` earliest(_time) as start_time latest(_time) as end_time values(All_Traffic.action) as action values(All_Traffic.app) as app values(All_Traffic.dest_ip) as dest_ip values(All_Traffic.dest_port) as dest_port values(sourcetype) as sourcetype count from datamodel=Network_Traffic where ((All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app="smb") AND NOT (All_Traffic.action="blocked" OR All_Traffic.dest_category="internal" OR All_Traffic.dest_ip=10.0.0.0/8 OR All_Traffic.dest_ip=172.16.0.0/12 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip=100.64.0.0/10)) by All_Traffic.src_ip +| `drop_dm_object_name("All_Traffic")` +| `security_content_ctime(start_time)` +| `security_content_ctime(end_time)` | `detect_outbound_smb_traffic_filter` ====Associated Analytic Story==== @@ -23108,7 +23108,7 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate, By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557.002/ T1557.002] * '''Last Updated''': 2020-10-28 @@ -23116,11 +23116,11 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
====Search==== -`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") -| eval src_interface=src_int_prefix_long+src_int_suffix -| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count by host src_interface -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +`cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") +| eval src_interface=src_int_prefix_long+src_int_suffix +| stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count by host src_interface +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_port_security_violation_filter` ====Associated Analytic Story==== @@ -23185,7 +23185,7 @@ This search might be prone to high false positives if you have malfunctioning de By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out DHCP leases to devices on the network (Man in the Middle attack). * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1557/ T1557] * '''Last Updated''': 2020-08-11 @@ -23193,8 +23193,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
====Search==== -`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" -| stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host +`cisco_networks` facility="DHCP_SNOOPING" mnemonic="DHCP_SNOOPING_UNTRUSTED_PORT" +| stats min(_time) AS firstTime max(_time) AS lastTime count values(message_type) AS message_type values(src_mac) AS src_mac BY host | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `detect_rogue_dhcp_server_filter` @@ -23259,7 +23259,7 @@ This search might be prone to high false positives if DHCP Snooping has been inc This search looks for commands that the SNICat tool uses in the TLS SNI field. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1041/ T1041] * '''Last Updated''': 2020-10-21 @@ -23267,7 +23267,7 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field.
====Search==== -`zeek_ssl` +`zeek_ssl` | rex field=server_name "(?(LIST |LS |SIZE @@ -23278,10 +23278,10 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. |ALIVE |EXIT |WHERE -|finito)-[A-Za-z0-9]{16}\.)" -| stats count by src_ip dest_ip server_name snicat -| where count>0 -| table src_ip dest_ip server_name snicat +|finito)-[A-Za-z0-9]{16}\.)" +| stats count by src_ip dest_ip server_name snicat +| where count>0 +| table src_ip dest_ip server_name snicat | `detect_snicat_sni_exfiltration_filter` ====Associated Analytic Story==== @@ -23347,10 +23347,10 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.transport=udp AND All_Traffic.dest_port=69) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch by All_Traffic.src All_Traffic.dest All_Traffic.dest_port -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.transport=udp AND All_Traffic.dest_port=69) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=21) OR (All_Traffic.transport=tcp AND All_Traffic.dest_port=22) AND All_Traffic.dest_category!=common_software_repo_destination AND All_Traffic.src_category=network OR All_Traffic.src_category=router OR All_Traffic.src_category=switch by All_Traffic.src All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `detect_software_download_to_network_device_filter` ====Associated Analytic Story==== @@ -23401,7 +23401,7 @@ This search will also report any legitimate attempts of software downloads to ne Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1200/ T1200], [https://attack.mitre.org/techniques/T1498/ T1498], [https://attack.mitre.org/techniques/T1020.001/ T1020.001] * '''Last Updated''': 2020-10-28 @@ -23409,10 +23409,10 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
====Search==== -`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") -| stats min(_time) AS firstTime max(_time) AS lastTime count BY host facility mnemonic +`cisco_networks` (facility="MIRROR" mnemonic="ETH_SPAN_SESSION_UP") OR (facility="SPAN" mnemonic="SESSION_UP") OR (facility="SPAN" mnemonic="PKTCAP_START") OR (mnemonic="CFGLOG_LOGGEDCMD" command="monitor session*") +| stats min(_time) AS firstTime max(_time) AS lastTime count BY host facility mnemonic | `security_content_ctime(firstTime)` -|`security_content_ctime(lastTime)` +|`security_content_ctime(lastTime)` | `detect_traffic_mirroring_filter` ====Associated Analytic Story==== @@ -23474,7 +23474,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Sessions -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-13
@@ -23482,14 +23482,14 @@ By populating the organization's assets within the assets_by_str.csv, we will be ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac +| tstats `security_content_summariesonly` count from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST by All_Sessions.src_ip All_Sessions.dest_mac | dedup All_Sessions.dest_mac | `drop_dm_object_name("Network_Sessions")` -|`drop_dm_object_name("All_Sessions")` +|`drop_dm_object_name("All_Sessions")` | search NOT [ -| inputlookup asset_lookup_by_str -|rename mac as dest_mac -| fields + dest_mac] +| inputlookup asset_lookup_by_str +|rename mac as dest_mac +| fields + dest_mac] | `detect_unauthorized_assets_by_mac_address_filter` ====Associated Analytic Story==== @@ -23533,7 +23533,7 @@ This search might be prone to high false positives. Please consider this when co This search detects SIGRed via Splunk Stream. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1203/ T1203] * '''Last Updated''': 2020-07-28 @@ -23541,15 +23541,15 @@ This search detects SIGRed via Splunk Stream.
====Search==== -`stream_dns` -| spath "query_type{}" -| search "query_type{}" IN (SIG,KEY) -| spath protocol_stack -| search protocol_stack="ip:tcp:dns" -| append [search `stream_tcp` bytes_out>65000] -| `detect_windows_dns_sigred_via_splunk_stream_filter` -| stats count by flow_id -| where count>1 +`stream_dns` +| spath "query_type{}" +| search "query_type{}" IN (SIG,KEY) +| spath protocol_stack +| search protocol_stack="ip:tcp:dns" +| append [search `stream_tcp` bytes_out>65000] +| `detect_windows_dns_sigred_via_splunk_stream_filter` +| stats count by flow_id +| where count>1 | fields - count ====Associated Analytic Story==== @@ -23611,14 +23611,14 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id -| rename DNS.flow_id as flow_id +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where DNS.query_type IN (SIG,KEY) by DNS.flow_id +| rename DNS.flow_id as flow_id | append [ -| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id -| rename All_Traffic.flow_id as flow_id] -| `detect_windows_dns_sigred_via_zeek_filter` -| stats count by flow_id -| where count>1 +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id +| rename All_Traffic.flow_id as flow_id] +| `detect_windows_dns_sigred_via_zeek_filter` +| stats count by flow_id +| where count>1 | fields - count ====Associated Analytic Story==== @@ -23671,7 +23671,7 @@ unknown This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1190/ T1190] * '''Last Updated''': 2020-09-15 @@ -23679,10 +23679,10 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul
====Search==== -`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) -| bin span=5m _time -| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip -| search opscount=3 authcount>4 passcount>0 +`zeek_rpc` operation IN (NetrServerPasswordSet2,NetrServerReqChallenge,NetrServerAuthenticate3) +| bin span=5m _time +| stats values(operation) dc(operation) as opscount count(eval(operation=="NetrServerReqChallenge")) as challenge count(eval(operation=="NetrServerAuthenticate3")) as authcount count(eval(operation=="NetrServerPasswordSet2")) as passcount count as totalcount by _time,src_ip,dest_ip +| search opscount=3 authcount>4 passcount>0 | search `detect_zerologon_via_zeek_filter` ====Associated Analytic Story==== @@ -23748,10 +23748,10 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p ====Search==== -| tstats `security_content_summariesonly` count values(DNS.answer) as answer min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host -| `drop_dm_object_name("DNS")` -| `security_content_ctime(firstTime)` -| `dynamic_dns_providers` +| tstats `security_content_summariesonly` count values(DNS.answer) as answer min(_time) as firstTime from datamodel=Network_Resolution by DNS.query host +| `drop_dm_object_name("DNS")` +| `security_content_ctime(firstTime)` +| `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter` ====Associated Analytic Story==== @@ -23839,7 +23839,7 @@ This search identifies DNS query failures by counting the number of DNS response | where isnull(rank) | stats sum(count) as count mode(queries) as queries by src | `get_asset(src)` -| where count>50 +| where count>50 | `excessive_dns_failures_filter` ====Associated Analytic Story==== @@ -23901,14 +23901,14 @@ This search looks for an increase of data transfers from your email server to yo ====Search==== -| tstats `security_content_summariesonly` sum(All_Traffic.bytes_in) as bytes_in from datamodel=Network_Traffic where All_Traffic.dest_category=email_server by All_Traffic.src_ip _time span=1d -| `drop_dm_object_name("All_Traffic")` -| eventstats avg(bytes_in) as avg_bytes_in stdev(bytes_in) as stdev_bytes_in -| eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_avg_bytes_in stdev(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_stdev_bytes_in by src_ip -| eval minimum_data_samples = 4, deviation_threshold = 3 -| where num_data_samples >= minimum_data_samples AND bytes_in > (avg_bytes_in + (deviation_threshold * stdev_bytes_in)) AND bytes_in > (per_source_avg_bytes_in + (deviation_threshold * per_source_stdev_bytes_in)) AND _time >= relative_time(now(), "@d") -| eval num_standard_deviations_away_from_server_average = round(abs(bytes_in - avg_bytes_in) / stdev_bytes_in, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_in - per_source_avg_bytes_in) / per_source_stdev_bytes_in, 2) -| table src_ip, _time, bytes_in, avg_bytes_in, per_source_avg_bytes_in, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average +| tstats `security_content_summariesonly` sum(All_Traffic.bytes_in) as bytes_in from datamodel=Network_Traffic where All_Traffic.dest_category=email_server by All_Traffic.src_ip _time span=1d +| `drop_dm_object_name("All_Traffic")` +| eventstats avg(bytes_in) as avg_bytes_in stdev(bytes_in) as stdev_bytes_in +| eventstats count as num_data_samples avg(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_avg_bytes_in stdev(eval(if(_time < relative_time(now(), "@d"), bytes_in, null))) as per_source_stdev_bytes_in by src_ip +| eval minimum_data_samples = 4, deviation_threshold = 3 +| where num_data_samples >= minimum_data_samples AND bytes_in > (avg_bytes_in + (deviation_threshold * stdev_bytes_in)) AND bytes_in > (per_source_avg_bytes_in + (deviation_threshold * per_source_stdev_bytes_in)) AND _time >= relative_time(now(), "@d") +| eval num_standard_deviations_away_from_server_average = round(abs(bytes_in - avg_bytes_in) / stdev_bytes_in, 2), num_standard_deviations_away_from_client_average = round(abs(bytes_in - per_source_avg_bytes_in) / per_source_stdev_bytes_in, 2) +| table src_ip, _time, bytes_in, avg_bytes_in, per_source_avg_bytes_in, num_standard_deviations_away_from_server_average, num_standard_deviations_away_from_client_average | `hosts_receiving_high_volume_of_network_traffic_from_email_server_filter` ====Associated Analytic Story==== @@ -23968,9 +23968,9 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" "DNS.record_type"="ANY" by "DNS.dest" -| `drop_dm_object_name("DNS")` -| where count>200 +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where nodename=DNS "DNS.message_type"="QUERY" "DNS.record_type"="ANY" by "DNS.dest" +| `drop_dm_object_name("DNS")` +| where count>200 | `large_volume_of_dns_any_queries_filter` ====Associated Analytic Story==== @@ -24030,12 +24030,12 @@ This search looks for network traffic defined by port and transport layer protoc ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action = allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action -| lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port OUTPUT app is_prohibited note transport -| search is_prohibited=true -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action = allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action +| lookup update=true interesting_ports_lookup dest_port as All_Traffic.dest_port OUTPUT app is_prohibited note transport +| search is_prohibited=true +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Traffic")` | `prohibited_network_traffic_allowed_filter` ====Associated Analytic Story==== @@ -24101,10 +24101,10 @@ This search looks for network traffic on common ports where a higher layer proto ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.app=dns NOT All_Traffic.dest_port=53) OR ((All_Traffic.app=web-browsing OR All_Traffic.app=http) NOT (All_Traffic.dest_port=80 OR All_Traffic.dest_port=8080 OR All_Traffic.dest_port=8000)) OR (All_Traffic.app=ssl NOT (All_Traffic.dest_port=443 OR All_Traffic.dest_port=8443)) OR (All_Traffic.app=smtp NOT All_Traffic.dest_port=25) by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.dest_port -|`security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where (All_Traffic.app=dns NOT All_Traffic.dest_port=53) OR ((All_Traffic.app=web-browsing OR All_Traffic.app=http) NOT (All_Traffic.dest_port=80 OR All_Traffic.dest_port=8080 OR All_Traffic.dest_port=8000)) OR (All_Traffic.app=ssl NOT (All_Traffic.dest_port=443 OR All_Traffic.dest_port=8443)) OR (All_Traffic.app=smtp NOT All_Traffic.dest_port=25) by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.app, All_Traffic.dest_port +|`security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Traffic")` | `protocol_or_port_mismatch_filter` ====Associated Analytic Story==== @@ -24158,7 +24158,7 @@ This search looks for cleartext protocols at risk of leaking credentials. Curren * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Network_Traffic -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2020-11-04
@@ -24166,10 +24166,10 @@ This search looks for cleartext protocols at risk of leaking credentials. Curren ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" OR All_Traffic.dest_port="110" OR (All_Traffic.dest_port="21" AND All_Traffic.user != "anonymous")) by All_Traffic.user All_Traffic.src All_Traffic.dest All_Traffic.dest_port -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" OR All_Traffic.dest_port="110" OR (All_Traffic.dest_port="21" AND All_Traffic.user != "anonymous")) by All_Traffic.user All_Traffic.src All_Traffic.dest All_Traffic.dest_port +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Traffic")` | `protocols_passing_authentication_in_cleartext_filter` ====Associated Analytic Story==== @@ -24220,11 +24220,11 @@ This search looks for RDP application network traffic and filters any source/des ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=rdp by All_Traffic.src All_Traffic.dest All_Traffic.dest_port -| eventstats stdev(count) AS stdev avg(count) AS avg p50(count) AS p50 -| where count>(avg + stdev*2) -| rename All_Traffic.src AS src All_Traffic.dest AS dest -| table firstTime lastTime src dest count avg p50 stdev +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=rdp by All_Traffic.src All_Traffic.dest All_Traffic.dest_port +| eventstats stdev(count) AS stdev avg(count) AS avg p50(count) AS p50 +| where count>(avg + stdev*2) +| rename All_Traffic.src AS src All_Traffic.dest AS dest +| table firstTime lastTime src dest count avg p50 stdev | `remote_desktop_network_bruteforce_filter` ====Associated Analytic Story==== @@ -24288,10 +24288,10 @@ This search looks for network traffic on TCP/3389, the default port used by remo ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source by All_Traffic.src All_Traffic.dest All_Traffic.dest_port -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.dest_port=3389 AND All_Traffic.dest_category!=common_rdp_destination AND All_Traffic.src_category!=common_rdp_source by All_Traffic.src All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name("All_Traffic")` | `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| `security_content_ctime(lastTime)` | `remote_desktop_network_traffic_filter` ====Associated Analytic Story==== @@ -24357,13 +24357,13 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src -| `drop_dm_object_name("All_Traffic")` -| eventstats max(_time) as maxtime -| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-70m@m"), count, null))) as count avg(eval(if(_time upperBound AND num_data_samples >=50, 1, 0) -| where isOutlier=1 -| table src count +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src +| `drop_dm_object_name("All_Traffic")` +| eventstats max(_time) as maxtime +| stats count as num_data_samples max(eval(if(_time >= relative_time(maxtime, "-70m@m"), count, null))) as count avg(eval(if(_time upperBound AND num_data_samples >=50, 1, 0) +| where isOutlier=1 +| table src count | `smb_traffic_spike_filter` ====Associated Analytic Story==== @@ -24429,15 +24429,15 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n ====Search==== -| tstats `security_content_summariesonly` count values(All_Traffic.dest_ip) as dest values(All_Traffic.dest_port) as port from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src -| eval HourOfDay=strftime(_time, "%H") -| eval DayOfWeek=strftime(_time, "%A") -| `drop_dm_object_name(All_Traffic)` -| apply smb_pdfmodel threshold=0.001 -| rename "IsOutlier(count)" as isOutlier -| search isOutlier > 0 -| sort -count -| table _time src dest port count +| tstats `security_content_summariesonly` count values(All_Traffic.dest_ip) as dest values(All_Traffic.dest_port) as port from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=1h, All_Traffic.src +| eval HourOfDay=strftime(_time, "%H") +| eval DayOfWeek=strftime(_time, "%A") +| `drop_dm_object_name(All_Traffic)` +| apply smb_pdfmodel threshold=0.001 +| rename "IsOutlier(count)" as isOutlier +| search isOutlier > 0 +| sort -count +| table _time src dest port count | `smb_traffic_spike___mltk_filter` ====Associated Analytic Story==== @@ -24506,10 +24506,10 @@ This search looks for network traffic identified as The Onion Router (TOR), a be ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `drop_dm_object_name("All_Traffic")` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.app=tor AND All_Traffic.action=allowed by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.action +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `drop_dm_object_name("All_Traffic")` | `tor_traffic_filter` ====Associated Analytic Story==== @@ -24566,18 +24566,18 @@ None at this time This search looks for unusually long strings in the Content-Type http header that the client sends the server. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2017-10-13
====Search==== -`stream_http` -| eval cs_content_type_length = len(cs_content_type) -| where cs_content_type_length > 100 -| table endtime src_ip dest_ip cs_content_type_length cs_content_type url +`stream_http` +| eval cs_content_type_length = len(cs_content_type) +| where cs_content_type_length > 100 +| table endtime src_ip dest_ip cs_content_type_length cs_content_type url | `unusually_long_content_type_length_filter` ====Associated Analytic Story==== @@ -24622,7 +24622,7 @@ Very few legitimate Content-Type fields will have a length greater than 100 char This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1190/ T1190] * '''Last Updated''': 2020-08-02 @@ -24630,9 +24630,9 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff
====Search==== -`f5_bigip_rogue` +`f5_bigip_rogue` | regex _raw="(hsqldb; -|.*\\.\\.;.*)" +|.*\\.\\.;.*)" | search `detect_f5_tmui_rce_cve_2020_5902_filter` ====Associated Analytic Story==== @@ -24698,10 +24698,10 @@ This search looks for specific GET or HEAD requests to web servers that are indi ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD") AND (Web.url="*/web-console/ServerInfo.jsp*" OR Web.url="*web-console*" OR Web.url="*jmx-console*" OR Web.url = "*invoker*") by Web.http_method, Web.url, Web.src, Web.dest -| `drop_dm_object_name("Web")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD") AND (Web.url="*/web-console/ServerInfo.jsp*" OR Web.url="*web-console*" OR Web.url="*jmx-console*" OR Web.url = "*invoker*") by Web.http_method, Web.url, Web.src, Web.dest +| `drop_dm_object_name("Web")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` ====Associated Analytic Story==== @@ -24755,7 +24755,7 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Web -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-23
@@ -24763,12 +24763,12 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con ====Search==== -| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD") by Web.http_method, Web.url,Web.url_length Web.src, Web.dest -| search Web.url="*jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin*import*" AND Web.url_length > 200 -| `drop_dm_object_name("Web")` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| table src, dest_ip, http_method, url, firstTime, lastTime +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD") by Web.http_method, Web.url,Web.url_length Web.src, Web.dest +| search Web.url="*jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin*import*" AND Web.url_length > 200 +| `drop_dm_object_name("Web")` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table src, dest_ip, http_method, url, firstTime, lastTime | `detect_malicious_requests_to_exploit_jboss_servers_filter` ====Associated Analytic Story==== @@ -24811,7 +24811,7 @@ This search looks for Web requests to faux domains similar to the one that you w * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Web -* '''ATT&CK''': +* '''ATT&CK''': * '''Last Updated''': 2017-09-23
@@ -24819,10 +24819,10 @@ This search looks for Web requests to faux domains similar to the one that you w ====Search==== -| tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src -| `drop_dm_object_name("Web")` -| `security_content_ctime(firstTime)` -| `brand_abuse_web` +| tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src +| `drop_dm_object_name("Web")` +| `security_content_ctime(firstTime)` +| `brand_abuse_web` | `monitor_web_traffic_for_brand_abuse_filter` ====Associated Analytic Story==== @@ -24871,10 +24871,10 @@ This search looks for long URLs that have several SQL commands visible within th ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent -| `drop_dm_object_name("Web")` -| eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url, "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url, "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join")) + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url, "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct")) + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url, "xp_cmdshell")) - 24 -| where num_sql_cmds > 3 +| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent +| `drop_dm_object_name("Web")` +| eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url, "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url, "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join")) + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url, "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct")) + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url, "xp_cmdshell")) - 24 +| where num_sql_cmds > 3 | `sql_injection_with_long_urls_filter` ====Associated Analytic Story==== @@ -24934,7 +24934,7 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. ====Search==== -| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR Web.url=*logoimagehandler.ashx*method* OR Web.url=*logoimagehandler.ashx*args* by Web.src Web.dest Web.url Web.vendor_product Web.user Web.http_user_agent _time span=1s +| tstats `security_content_summariesonly` count from datamodel=Web.Web where web.url=*logoimagehandler.ashx*codes* OR Web.url=*logoimagehandler.ashx*clazz* OR Web.url=*logoimagehandler.ashx*method* OR Web.url=*logoimagehandler.ashx*args* by Web.src Web.dest Web.url Web.vendor_product Web.user Web.http_user_agent _time span=1s | `supernova_webshell_filter` ====Associated Analytic Story==== @@ -24989,7 +24989,7 @@ There might be false positives associted with this detection since items like ar This search is used to identify the creation of multiple user accounts using the same email domain name. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1136/ T1136] * '''Last Updated''': 2018-10-08 @@ -24997,14 +24997,14 @@ This search is used to identify the creation of multiple user accounts using the
====Search==== -`stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" -| rex field=cookie "form_key=(?\w+)" +`stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" +| rex field=cookie "form_key=(?\w+)" | rex field=form_data "login\[username\]=(?[^& -|^$]+)" -| search Username=* -| rex field=Username "@(?.*)" -| stats dc(Username) as UniqueUsernames list(Username) as src_user by email_domain -| where UniqueUsernames> 25 +|^$]+)" +| search Username=* +| rex field=Username "@(?.*)" +| stats dc(Username) as UniqueUsernames list(Username) as src_user by email_domain +| where UniqueUsernames> 25 | `web_fraud___account_harvesting_filter` ====Associated Analytic Story==== @@ -25059,7 +25059,7 @@ As is common with many fraud-related searches, we are usually looking to attribu This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': +* '''Datamodel''': * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2018-10-08 @@ -25067,12 +25067,12 @@ This search is used to examine web sessions to identify those where the clicks a
====Search==== -`stream_http` http_content_type=text* -| rex field=cookie "form_key=(?\w+)" -| streamstats window=2 current=1 range(_time) as TimeDelta by session_id -| where TimeDelta>0 -|stats count stdev(TimeDelta) as ClickSpeedStdDev avg(TimeDelta) as ClickSpeedAvg by session_id -| where count>5 AND (ClickSpeedStdDev<.5 OR ClickSpeedAvg<.5) +`stream_http` http_content_type=text* +| rex field=cookie "form_key=(?\w+)" +| streamstats window=2 current=1 range(_time) as TimeDelta by session_id +| where TimeDelta>0 +|stats count stdev(TimeDelta) as ClickSpeedStdDev avg(TimeDelta) as ClickSpeedAvg by session_id +| where count>5 AND (ClickSpeedStdDev<.5 OR ClickSpeedAvg<.5) | `web_fraud___anomalous_user_clickspeed_filter` ====Associated Analytic Story==== @@ -25131,21 +25131,21 @@ As is common with many fraud-related searches, we are usually looking to attribu This search is used to identify user accounts that share a common password. * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -* '''Datamodel''': -* '''ATT&CK''': +* '''Datamodel''': +* '''ATT&CK''': * '''Last Updated''': 2018-10-08
====Search==== -`stream_http` http_content_type=text* uri=/magento2/customer/account/loginPost* +`stream_http` http_content_type=text* uri=/magento2/customer/account/loginPost* | rex field=form_data "login\[username\]=(?[^& -|^$]+)" +|^$]+)" | rex field=form_data "login\[password\]=(?[^& -|^$]+)" +|^$]+)" | stats dc(Username) as UniqueUsernames values(Username) as user list(src_ip) as src_ip by Password -|where UniqueUsernames>5 +|where UniqueUsernames>5 | `web_fraud___password_sharing_across_accounts_filter` ====Associated Analytic Story==== @@ -25190,11 +25190,11 @@ As is common with many fraud-related searches, we are usually looking to attribu -''#############'' -''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -''# On Date: UTC'' -''# Author: Splunk Security Research'' -''# Contact: research@splunk.com'' -''#############'' - -[[Category:V:ESSOC:drafts]] \ No newline at end of file +'' +############# +# Automatically generated by doc_gen.py in https://github.com/splunk/security_content +# On Date: 2021-03-24 17:37:00.842958 UTC +# Author: Splunk Security Research +# Contact: research@splunk.com +############# +'' diff --git a/docs/stories.wiki b/docs/stories.wiki index 0f2f16281c..d2fdf91c86 100644 --- a/docs/stories.wiki +++ b/docs/stories.wiki @@ -5773,11 +5773,11 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi -''#############'' -''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -''# On Date: UTC'' -''# Author: Splunk Security Research'' -''# Contact: research@splunk.com'' -''#############'' - -[[Category:V:ESSOC:drafts]] \ No newline at end of file +'' +############# +# Automatically generated by doc_gen.py in https://github.com/splunk/security_content +# On Date: 2021-03-24 17:37:01.248549 UTC +# Author: Splunk Security Research +# Contact: research@splunk.com +############# +''