diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py index de9b944ab4..44cea37840 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py @@ -9,32 +9,6 @@ class FindingReportObject(): @staticmethod def writeFindingReport(detection : Detection) -> None: - - # if detection.tags.confidence < 33: - # detection.tags.confidence_id = 1 - # elif detection.tags.confidence < 66: - # detection.tags.confidence_id = 2 - # else: - # detection.tags.confidence_id = 3 - - # detection.tags.context_ids = list() - # for context in detection.tags.context: - # detection.tags.context_ids.append(SES_CONTEXT_MAPPING[context]) - - # if detection.tags.impact < 20: - # detection.tags.impact_id = 1 - # elif detection.tags.impact < 40: - # detection.tags.impact_id = 2 - # elif detection.tags.impact < 60: - # detection.tags.impact_id = 3 - # elif detection.tags.impact < 80: - # detection.tags.impact_id = 4 - # else: - # detection.tags.impact_id = 5 - - # detection.tags.kill_chain_phases_id = dict() - # for kill_chain_phase in detection.tags.kill_chain_phases: - # detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase] if detection.tags.risk_score < 20: @@ -53,15 +27,6 @@ class FindingReportObject(): detection.tags.risk_level_id = 4 detection.tags.risk_level = "Critical" - # observable_str = "[" - # for i in range(len(detection.tags.observable)): - # observable_str = observable_str + 'create_map("name", "' + detection.tags.observable[i]["name"] + '", "type_id", ' + str(SES_OBSERVABLE_TYPE_MAPPING[detection.tags.observable[i]["type"]]) + ', "value", ' + detection.tags.observable[i]["name"].replace(".", "_") + ')' - # if not i == (len(detection.tags.observable) - 1): - # observable_str = observable_str + ', ' - # observable_str = observable_str + ']' - - # detection.tags.observable_str = observable_str - evidence_str = "create_map(" for i in range(len(detection.tags.observable)): evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_") @@ -71,10 +36,15 @@ class FindingReportObject(): detection.tags.evidence_str = evidence_str + if "actor.user.name" in detection.tags.required_fields: + actor_user_name = "actor_user_name" + else: + actor_user_name = "\"Unknown\"" + j2_env = Environment( loader=FileSystemLoader(os.path.join(os.path.dirname(__file__), 'templates')), trim_blocks=True) template = j2_env.get_template('finding_report.j2') - body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING) + body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING, actor_user_name=actor_user_name) return body diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 index 8d7f9fc24b..80d533ffb9 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2 @@ -7,10 +7,10 @@ ], "time", timestamp, "evidence", {{ detection.tags.evidence_str }}, - "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", process_user_name, "."), + "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py b/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py index 0ed326be9e..930a20fbd4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py @@ -28,7 +28,6 @@ class SigmaConverterInputDto: detection_folder : str input_path: str log_source: str - cim_to_ocsf: bool @dataclass(frozen=True) @@ -159,9 +158,9 @@ class SigmaConverter(): cim_to_ocsf_mapping = self.get_cim_to_ocsf_mapping(data_source_new) - elif input_dto.cim_to_ocsf: - field_mapping = self.get_cim_to_ocsf_mapping(data_source) - cim_to_ocsf_mapping = field_mapping + # elif input_dto.cim_to_ocsf: + # field_mapping = self.get_cim_to_ocsf_mapping(data_source) + # cim_to_ocsf_mapping = field_mapping else: field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'ocsf') @@ -171,7 +170,7 @@ class SigmaConverter(): for field in field_mapping_underline["mapping"].keys(): field_mapping_underline["mapping"][field] = field_mapping_underline["mapping"][field].replace(".", "_") - self.add_required_fields(field_mapping, detection) + self.add_required_fields(cim_to_ocsf_mapping, detection) self.add_mappings(cim_to_ocsf_mapping, detection) self.update_observables(detection) @@ -189,7 +188,7 @@ class SigmaConverter(): ) ) - detection = self.convert_detection_fields(detection, field_mapping_underline) + detection = self.convert_detection_fields(detection) sigma_rule = self.get_sigma_rule(detection, data_source) sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items) @@ -248,15 +247,27 @@ class SigmaConverter(): }]) - def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection: + # def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection: + # for selection in detection.search.keys(): + # if selection != "condition": + # new_selection = copy.deepcopy(detection.search[selection]) + # for field in detection.search[selection].keys(): + # for mapping in mappings["mapping"].keys(): + # if mapping == field: + # new_selection[mappings["mapping"][mapping]] = detection.search[selection][field] + # new_selection.pop(field) + # detection.search[selection] = new_selection + + # return detection + + def convert_detection_fields(self, detection: Detection) -> Detection: for selection in detection.search.keys(): if selection != "condition": new_selection = copy.deepcopy(detection.search[selection]) for field in detection.search[selection].keys(): - for mapping in mappings["mapping"].keys(): - if mapping == field: - new_selection[mappings["mapping"][mapping]] = detection.search[selection][field] - new_selection.pop(field) + new_field_name = field.replace(".", "_") + new_selection[new_field_name] = detection.search[selection][field] + new_selection.pop(field) detection.search[selection] = new_selection return detection @@ -337,14 +348,9 @@ class SigmaConverter(): def add_required_fields(self, field_mapping: dict, detection: Detection) -> None: required_fields = list() - required_fields = ["process.user.name", "device.hostname"] +# required_fields = ["process.user.name", "device.hostname"] for mapping in field_mapping["mapping"].keys(): - for selection in detection.search.keys(): - if selection != "condition": - for detection_field in detection.search[selection]: - if detection_field.startswith(mapping): - if not field_mapping["mapping"][mapping] in required_fields: - required_fields.append(field_mapping["mapping"][mapping]) + required_fields.append(field_mapping["mapping"][mapping]) detection.tags.required_fields = required_fields @@ -361,14 +367,19 @@ class SigmaConverter(): def update_observables(self, detection : Detection) -> None: mapping_field_to_type = { "process.user.name": "User Name", + "actor.user.name": "User Name", "device.hostname": "Hostname", "process.file.name": "File Name", "actor.process.file.name": "File Name", "actor.process.file.path": "File Name", "actor.process.cmd_line": "Process", + "actor.user.uid": "Other", "process.cmd_line": "Other", "process.file.path": "File", - "process.file.name": "File" + "process.file.name": "File", + "process.uid": "Other", + "process.pid": "Other", + "actor.process.pid": "Other" } observables = list() diff --git a/contentctl.py b/contentctl.py index 5e184ed44a..2df250e5a8 100644 --- a/contentctl.py +++ b/contentctl.py @@ -312,8 +312,6 @@ def convert(args) -> None: data_model = SigmaConverterTarget.RAW elif args.data_model == 'ocsf': data_model = SigmaConverterTarget.OCSF - elif args.data_model == 'all': - data_model = SigmaConverterTarget.ALL else: print("ERROR: data model " + args.data_model + " not supported") sys.exit(1) @@ -323,8 +321,7 @@ def convert(args) -> None: detection_path = args.detection_path, detection_folder = args.detection_folder, input_path = args.path, - log_source = args.log_source, - cim_to_ocsf = args.cim_to_ocsf + log_source = args.log_source ) convert_input_dto = ConvertInputDto( @@ -414,7 +411,6 @@ def main(args): convert_parser.add_argument("-lo", "--log_source", required=False, type=str, help="converter log source") convert_parser.add_argument("-dp", "--detection_path", required=False, type=str, help="path to a single detection") convert_parser.add_argument("-df", "--detection_folder", required=False, type=str, help="path to a detection folder") - convert_parser.add_argument("-cto", "--cim_to_ocsf", action=argparse.BooleanOptionalAction, help="temp: cim to ocsf") convert_parser.add_argument("-o", "--output", required=True, type=str, help="output path to store the detections") convert_parser.set_defaults(func=convert) diff --git a/data_sources/endpoint/Powershell_4104.yml b/data_sources/endpoint/Powershell_4104.yml index fe833c643d..58fa172919 100644 --- a/data_sources/endpoint/Powershell_4104.yml +++ b/data_sources/endpoint/Powershell_4104.yml @@ -21,4 +21,21 @@ raw_fields: - MessageNumber - MessageTotal - ScriptBlockId - - ScriptBlockText \ No newline at end of file + - ScriptBlockText + - Path +field_mappings: + - data_model: cim + data_set: Endpoint.Processes + mapping: + Computer: Processes.dest + Path: Processes.process_path + ScriptBlockId: Processes.process_id + ScriptBlockText: Processes.process + UserID: Processes.user_id + - data_model: ocsf + mapping: + Computer: device.hostname + Path: process.file.path + ScriptBlockId: process.uid + ScriptBlockText: process.cmd_line + UserID: actor.user.uid diff --git a/data_sources/endpoint/Windows_Security_4688.yml b/data_sources/endpoint/Windows_Security_4688.yml index 557bd68733..09244e52b1 100644 --- a/data_sources/endpoint/Windows_Security_4688.yml +++ b/data_sources/endpoint/Windows_Security_4688.yml @@ -44,7 +44,7 @@ field_mappings: NewProcessName: process.file.path NewProcessName|endswith: process.file.name Process_Command_Line: process.cmd_line - SubjectUserSid: process.user.name + SubjectUserSid: actor.user.name ProcessId: actor.process.pid ParentProcessName: actor.process.file.path ParentProcessName|endswith: actor.process.file.name diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 357f46c182..fcb9447740 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,16 +1,14 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 2 -date: '2021-11-03' +version: 3 +date: '2023-05-15' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: TTP description: 'This search looks for the execution of `adfind.exe` with command-line - arguments that it uses by default. Specifically the filter or search functions. + arguments that it uses by default specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more - details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been - seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. - AdFind.exe is usually used a recon tool to enumare a domain controller.' + details: https://www.joeware.net/freetools/tools/adfind/usage.htm. AdFind.exe is a powerful tool that is commonly used for querying and retrieving information from Active Directory (AD). While it is primarily designed for AD administration and management, it has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.' data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -23,11 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators rarely use adfind, usually not used for legitimate - reasons +known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro. references: - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption +- https://www.joeware.net/freetools/tools/adfind/index.htm tags: analytic_story: - NOBELIUM Group diff --git a/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml index 8232dfc360..433e447c3b 100644 --- a/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -11,13 +11,13 @@ data_source: - Windows Security 4688 search: selection1: - process_name: WinRAR.exe + process.file.name: WinRAR.exe selection2: - process_name|startswith: 7z + process.file.name|startswith: 7z selection3: - process_name|startswith: winzip + process.file.name|startswith: winzip selection4: - parent_process_name|endswith: + actor.process.file.name|endswith: - powershell.exe - cmd.exe condition: (selection1 or selection2 or selection3) and selection4 @@ -42,33 +42,10 @@ tags: mitre_attack_id: - T1560.001 - T1560 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 42 diff --git a/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml b/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml index d2988fd987..62b4089a60 100644 --- a/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml +++ b/dev_ssa/endpoint/ssa___attempt_to_delete_services.yml @@ -14,8 +14,8 @@ data_source: - Windows Security 4688 search: selection1: - process_name: sc.exe - process|contains: delete + process.file.name: sc.exe + process.cmd_line|contains: delete condition: selection1 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -39,34 +39,10 @@ tags: - T1489 - T1543 - T1543.003 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 36 diff --git a/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml b/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml index c906ddef25..97b08c5787 100644 --- a/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml +++ b/dev_ssa/endpoint/ssa___attempt_to_disable_services.yml @@ -14,11 +14,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: config + process.cmd_line|contains: config selection2: - process|contains: disabled + process.cmd_line|contains: disabled selection3: - process_name: sc.exe + process.file.name: sc.exe condition: selection1 and selection2 and selection3 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -41,33 +41,10 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service. mitre_attack_id: - T1489 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 36 diff --git a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index fcdce12519..d5f7875df1 100644 --- a/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,11 +12,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - reg.exe - cmd.exe selection2: - process|re: + process.cmd_line|re: - HKEY_LOCAL_MACHINE\System - HKEY_LOCAL_MACHINE\SAM - HKEY_LOCAL_MACHINE\Security @@ -24,7 +24,7 @@ search: - HKLM\SAM - HKLM\Security selection3: - process|re: save + process.cmd_line|re: save condition: selection1 and (selection2) and selection3 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -40,32 +40,15 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: An attempt to save registry keys storing credentials has been performed on + message: An attempt to save registry keys storing credentials has been performed + on mitre_attack_id: - T1003 - T1003.002 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 63 diff --git a/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml index 7ce2d5fd8b..f8f78cbdaf 100644 --- a/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -12,11 +12,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: bcdedit.exe + process.file.name: bcdedit.exe selection2: - process|contains: 'no' + process.cmd_line|contains: 'no' selection3: - process|contains: recoveryenabled + process.cmd_line|contains: recoveryenabled condition: selection1 and (selection2 and selection3) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -37,34 +37,10 @@ tags: to recover the endpoint. mitre_attack_id: - T1490 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index 2f577ad6d6..73cc76ab89 100644 --- a/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -12,8 +12,8 @@ data_source: - Windows Security 4688 search: selection1: - process_name: cipher.exe - process|contains: '/W:' + process.file.name: cipher.exe + process.cmd_line|contains: '/W:' condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -35,38 +35,10 @@ tags: mitre_attack_id: - T1070.004 - T1070 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + required_fields: [] kill_chain_phases: - Exploitation risk_score: 90 diff --git a/dev_ssa/endpoint/ssa___delete_a_net_user.yml b/dev_ssa/endpoint/ssa___delete_a_net_user.yml index c58c054810..03b193c10b 100644 --- a/dev_ssa/endpoint/ssa___delete_a_net_user.yml +++ b/dev_ssa/endpoint/ssa___delete_a_net_user.yml @@ -15,11 +15,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: user + process.cmd_line|contains: user selection2: - process|contains: /delete + process.cmd_line|contains: /delete selection3: - process_name: + process.file.name: - net.exe - net1.exe condition: selection1 and selection2 and (selection3) @@ -43,34 +43,10 @@ tags: account. mitre_attack_id: - T1531 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml b/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml index 35254c6253..aef73fde30 100644 --- a/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -13,11 +13,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - icacls.exe - xcacls.exe - cacls.exe - process|re: deny + process.cmd_line|re: deny condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -34,30 +34,14 @@ tags: asset_type: Endpoint confidence: 70 impact: 50 - message: A cacls process $process_name$ with commandline $process$ try to deny - a permission of a file or directory in host $dest_device_id$ + message: A cacls process $process_name$ with commandline $process$ try to deny a + permission of a file or directory in host $dest_device_id$ mitre_attack_id: - T1222 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index efb4c8b3de..a506cb395b 100644 --- a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -11,27 +11,28 @@ description: The following analytic identifies parent processes, browsers, Windo need to be tuned to further enhance the risk. data_source: - Windows Security 4688 -search: +search: selection1: - parent_process_name: - - winword.exe - - excel.exe - - outlook.exe - - acrobat.exe - - acrord32.exe - - iexplore.exe - - opera.exe - - firefox.exe - - powershell.exe + actor.process.file.name: + - winword.exe + - excel.exe + - outlook.exe + - acrobat.exe + - acrord32.exe + - iexplore.exe + - opera.exe + - firefox.exe + - powershell.exe selection2: - parent_process_name: java.exe + actor.process.file.name: java.exe selection3: - parent_process_name|re: patch1-Hotfix1a + actor.process.file.name|re: patch1-Hotfix1a selection4: - parent_process_name: chrome.exe + actor.process.file.name: chrome.exe selection5: - process: chrome-extension - condition: selection1 or (selection2 and not selection3) or (selection4 and not selection5) + process.cmd_line: chrome-extension + condition: selection1 or (selection2 and not selection3) or (selection4 and not + selection5) how_to_implement: In order to successfully implement this analytic, you will need endpoint process data from a EDR product or Sysmon. This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP. @@ -51,32 +52,10 @@ tags: that warrants investigating. mitre_attack_id: - T1059 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - process_name - - parent_process_name - - _time - - dest_device_id - - dest_user_id - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml b/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml index 5f26ae9337..c7daaf57c8 100644 --- a/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - --multi-thread-streams - --transfers - --auto-confirm @@ -28,7 +28,7 @@ search: - pcloud - mega - copy - process_name: rclone.exe + process.file.name: rclone.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,34 +53,10 @@ tags: remote cloud service to move files or folders. mitre_attack_id: - T1020 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___disable_net_user_account.yml b/dev_ssa/endpoint/ssa___disable_net_user_account.yml index ff6cf68d59..6637f6f59e 100644 --- a/dev_ssa/endpoint/ssa___disable_net_user_account.yml +++ b/dev_ssa/endpoint/ssa___disable_net_user_account.yml @@ -13,11 +13,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: user + process.cmd_line|contains: user selection2: - process|contains: /active:no + process.cmd_line|contains: /active:no selection3: - process_name: + process.file.name: - net.exe - net1.exe condition: selection1 and selection2 and (selection3) @@ -42,34 +42,10 @@ tags: mitre_attack_id: - T1489 - T1078 - observable: - - name: user - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 192c04d0ff..6b381af469 100644 --- a/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -15,13 +15,13 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - -retry= - -type= - -q= - -qt= - -querytype= - process_name: nslookup.exe + process.file.name: nslookup.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -46,34 +46,10 @@ tags: to DNS exfiltration. mitre_attack_id: - T1048 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 72 diff --git a/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml b/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml index 305ca90634..1f5c773b10 100644 --- a/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml +++ b/dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml @@ -12,8 +12,8 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: setzerodata - process_name: fsutil.exe + process.cmd_line|contains: setzerodata + process.file.name: fsutil.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -37,34 +37,10 @@ tags: deletion. mitre_attack_id: - T1070 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 54 diff --git a/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml b/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml index 82259af017..0777f5a274 100644 --- a/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -13,11 +13,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - icacls.exe - xcacls.exe - cacls.exe - process|re: grant + process.cmd_line|re: grant condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -38,26 +38,10 @@ tags: user a permission to a file or directory in host $dest_device_id$ mitre_attack_id: - T1222 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index 381b1a1edc..6547581f8c 100644 --- a/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -13,8 +13,8 @@ data_source: - Windows Security 4688 search: selection1: - process_name: attrib.exe - process|re: '' + process.file.name: attrib.exe + process.cmd_line|re: '' condition: selection1 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -38,24 +38,10 @@ tags: mitre_attack_id: - T1222.001 - T1222 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process - type: Other - role: - - Attacker - - Parent Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time + required_fields: [] kill_chain_phases: - Exploitation risk_score: 72 diff --git a/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index 9e65235213..7c6a432320 100644 --- a/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -15,12 +15,12 @@ data_source: - Windows Security 4688 search: selection1: - process|re: + process.cmd_line|re: - 'S-1-1-0:' - 'SYSTEM:' - 'everyone:' selection2: - process_name: + process.file.name: - icacls.exe - xcacls.exe - cacls.exe @@ -43,26 +43,10 @@ tags: a permission of a file or directory in host $dest_device_id$ mitre_attack_id: - T1222 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml b/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml index bfd8a386d7..469e04e1f9 100644 --- a/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -12,10 +12,10 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - cscript.exe - wscript.exe - parent_process_name|re: + actor.process.file.name|re: - visio.exe - mspub.exe - powerpnt.exe @@ -41,33 +41,10 @@ tags: mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 63 diff --git a/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml b/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml index 1cf3af9c8c..042319c39d 100644 --- a/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml @@ -13,13 +13,13 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: shadowstorage + process.cmd_line|contains: shadowstorage selection2: - process|contains: resize + process.cmd_line|contains: resize selection3: - process|contains: maxsize + process.cmd_line|contains: maxsize selection4: - process_name: vssadmin.exe + process.file.name: vssadmin.exe condition: selection1 and selection2 and selection3 and selection4 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -42,34 +42,10 @@ tags: copy to perform offline password cracking. mitre_attack_id: - T1489 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 64 diff --git a/dev_ssa/endpoint/ssa___sdelete_application_execution.yml b/dev_ssa/endpoint/ssa___sdelete_application_execution.yml index 7498732709..a64303b921 100644 --- a/dev_ssa/endpoint/ssa___sdelete_application_execution.yml +++ b/dev_ssa/endpoint/ssa___sdelete_application_execution.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - .xls - .gz - .tar @@ -42,7 +42,7 @@ search: - '-p ' - '-f ' - '-c ' - process_name|contains: sdelete + process.file.name|contains: sdelete condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -66,36 +66,10 @@ tags: - T1485 - T1070.004 - T1070 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest - - user - - parent_process_name - - parent_process - - process_name - - process - - process_id - - process_path - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 42 diff --git a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml b/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml index 555b63bb31..823a771d5b 100644 --- a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - xwizard.exe - xpsrchvw.exe - xcopy.exe @@ -577,9 +577,9 @@ search: - adaptertroubleshooter.exe - arp.exe selection2: - process_path|re: \\windows\\syswow64 + process.file.path|re: \\windows\\syswow64 selection3: - process_path|re: \\windows\\system32 + process.file.path|re: \\windows\\system32 condition: selection1 and not selection2 and not selection3 how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: None @@ -595,23 +595,10 @@ tags: folder path in host $dest_device_id$ mitre_attack_id: - T1036 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 56 diff --git a/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml b/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml index e8aa9807b8..ff1fcfe35f 100644 --- a/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -12,9 +12,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: wbadmin.exe + process.file.name: wbadmin.exe selection2: - process|contains: + process.cmd_line|contains: - systemstatebackup - catalog - delete @@ -40,34 +40,10 @@ tags: backups. mitre_attack_id: - T1490 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 15 diff --git a/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 17a2c86635..e49548cd0a 100644 --- a/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -12,15 +12,15 @@ data_source: - Windows Security 4688 search: selection1: - process|re: + process.cmd_line|re: - powershell - setup - application - sysmon - system - security - process|contains: ' cl ' - process_name: wevtutil.exe + process.cmd_line|contains: ' cl ' + process.file.name: wevtutil.exe condition: (selection1) how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -41,30 +41,15 @@ tags: asset_type: Endpoint confidence: 90 impact: 70 - message: A wevtutil process $process_name$ with commandline $process$ to clear - event logs in host $dest_device_id$ + message: A wevtutil process $process_name$ with commandline $process$ to clear event + logs in host $dest_device_id$ mitre_attack_id: - T1070 - T1070.001 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 63 diff --git a/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index a3878b7433..d26a025250 100644 --- a/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -12,11 +12,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: /e:false + process.cmd_line|contains: /e:false selection2: - process|contains: ' sl ' + process.cmd_line|contains: ' sl ' selection3: - process_name: wevtutil.exe + process.file.name: wevtutil.exe condition: selection1 and selection2 and selection3 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -41,25 +41,10 @@ tags: mitre_attack_id: - T1070 - T1070.001 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 63 diff --git a/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml b/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml index 87659b9104..a7b9df6a72 100644 --- a/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml +++ b/dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - resume - setcustomheaders - setminretrydelay @@ -24,7 +24,7 @@ search: - setnotifyflags - addfile - create - process_name: bitsadmin.exe + process.file.name: bitsadmin.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -50,34 +50,10 @@ tags: on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS. mitre_attack_id: - T1197 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 56 diff --git a/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml b/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml index 5d925f4ae9..4c0b82b297 100644 --- a/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -21,8 +21,8 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: transfer - process_name: bitsadmin.exe + process.cmd_line|contains: transfer + process.file.name: bitsadmin.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -50,34 +50,10 @@ tags: mitre_attack_id: - T1197 - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml b/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml index 6c03cb88ea..867a213750 100644 --- a/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml +++ b/dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml @@ -17,8 +17,8 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: decode - process_name: certutil.exe + process.cmd_line|contains: decode + process.file.name: certutil.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -45,34 +45,10 @@ tags: on disk. mitre_attack_id: - T1140 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 40 diff --git a/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml b/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml index 528fa99a94..3da51c21c3 100644 --- a/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -16,13 +16,13 @@ data_source: - Windows Security 4688 search: selection1: - process_name: certutil.exe + process.file.name: certutil.exe selection2: - process|contains: split + process.cmd_line|contains: split selection3: - process|contains: urlcache + process.cmd_line|contains: urlcache selection4: - process|contains: urlcache + process.cmd_line|contains: urlcache condition: selection1 and selection2 and selection3 or selection4 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -45,34 +45,10 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. mitre_attack_id: - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 90 diff --git a/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml b/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml index 84a47886f0..0b7bff2945 100644 --- a/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -16,13 +16,13 @@ data_source: - Windows Security 4688 search: selection1: - process_name: certutil.exe + process.file.name: certutil.exe selection2: - process|contains: split + process.cmd_line|contains: split selection3: - process|contains: verifyctl + process.cmd_line|contains: verifyctl selection4: - process|contains: verifyctl + process.cmd_line|contains: verifyctl condition: selection1 and selection2 and selection3 or selection4 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -46,34 +46,10 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file. mitre_attack_id: - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 90 diff --git a/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index 49a604dd19..aeb59e2dde 100644 --- a/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -17,8 +17,8 @@ data_source: - Windows Security 4688 search: selection1: - process|re: inprocserver32 - process_name: reg.exe + process.cmd_line|re: inprocserver32 + process.file.name: reg.exe condition: selection1 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -40,34 +40,10 @@ tags: mitre_attack_id: - T1546.015 - T1546 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 64 diff --git a/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index df5dd1fa53..348cde2ed1 100644 --- a/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -27,13 +27,13 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - '-F ' - '--data ' - '-d ' - '--upload-file ' - '-T ' - process_name|re: curl.exe + process.file.name|re: curl.exe condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -56,34 +56,10 @@ tags: destination. mitre_attack_id: - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index 5c83ba0fee..0b8a2628c9 100644 --- a/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -11,11 +11,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name|re: mpcmdrun.exe + process.file.name|re: mpcmdrun.exe selection2: - process_path|re: \\windows defender + process.file.path|re: \\windows defender selection3: - process_path|re: \\microsoft\\windows defender\\platform + process.file.path|re: \\microsoft\\windows defender\\platform condition: selection1 and not selection2 and not selection3 how_to_implement: Collect endpoint data such as sysmon or 4688 events. known_false_positives: False positives may be present and filtering may be required. @@ -33,24 +33,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 56 diff --git a/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml index 1d8a211cb0..a61244c020 100644 --- a/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -15,10 +15,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - /s - -S - process_name: diskshadow.exe + process.file.name: diskshadow.exe condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from @@ -37,34 +37,10 @@ tags: on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script. mitre_attack_id: - T1218 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index 39ead238cc..e27c7cf0e8 100644 --- a/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -15,7 +15,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name|re: + process.file.name|re: - MSBuild.exe - comsvcconfig.exe - dfsradmin.exe @@ -60,7 +60,7 @@ search: - filehistory.exe - secureassessmentbrowser.exe selection2: - process_path|re: + process.file.path|re: - \\windows\\system32 - \\windows\\syswow64 - \\windows\\adws @@ -95,24 +95,10 @@ tags: - T1036.003 - T1218 - T1218.004 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml index 908c66d8fa..de2e497520 100644 --- a/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -28,10 +28,10 @@ description: 'The following analytic identifies the usage of Exchange PowerShell This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).' data_source: -- Windows Security 4688 +- Powershell 4104 search: selection1: - process|re: + process.cmd_line|re: - get-recipient - new-mailboxsearch - new-managementroleassignment @@ -63,22 +63,10 @@ tags: mitre_attack_id: - T1059 - T1059.001 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 32 diff --git a/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 9e28508cce..ee26fe9a23 100644 --- a/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -14,20 +14,20 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - ms-msdt:/id - ms-msdt:-id - ms-msdt:/id - 'ms-msdt:' - msdt - process_name: msdt.exe + process.file.name: msdt.exe selection2: - process|re: + process.cmd_line|re: - .xml - it_rebrowseforfile= - it_browseforfile= selection3: - process|re: pcwdiagnostic + process.cmd_line|re: pcwdiagnostic condition: selection1 and selection2 and selection3 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -54,30 +54,10 @@ tags: of indirect command execution. mitre_attack_id: - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 100 diff --git a/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index 593581b451..4bea1911fe 100644 --- a/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -17,10 +17,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - https:// - http:// - process_name: explorer.exe + process.file.name: explorer.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -40,34 +40,10 @@ tags: destination to download an additional payload. mitre_attack_id: - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 25 diff --git a/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index 2c227b9232..aa613ac676 100644 --- a/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -12,9 +12,9 @@ description: The following analytic identifies native living off the land binari regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries. data_source: - Windows Security 4688 -search: +search: selection1: - process_name: + process.file.name: - bitsadmin.exe - certoc.exe - certreq.exe @@ -96,7 +96,7 @@ search: - wuauclt.exe - xwizard.exe selection2: - process_path|re: + process.file.path|re: - (?i)\\windows\\system32 - (?i)\\windows\\syswow64 - (?i)\\windows\\networkcontrolle @@ -128,24 +128,10 @@ tags: - T1036.003 - T1218 - T1218.004 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml b/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml index 278504d8bb..485564bca7 100644 --- a/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml +++ b/dev_ssa/endpoint/ssa___windows_mshta_child_process.yml @@ -13,7 +13,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - wscript.exe - cscript.exe - searchprotocolhost.exe @@ -23,7 +23,7 @@ search: - scrcons.exe - cmd.exe - powershell.exe - parent_process_name|endswith: mshta.exe + actor.process.file.name|endswith: mshta.exe condition: selection1 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -47,34 +47,10 @@ tags: mitre_attack_id: - T1218.005 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml b/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml index 9ec3c5ecbe..6fec24fc9f 100644 --- a/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml @@ -16,10 +16,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - https:// - http:// - process_name: mshta.exe + process.file.name: mshta.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -45,34 +45,10 @@ tags: mitre_attack_id: - T1218.005 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 9d307932a8..d6c560ff6e 100644 --- a/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -14,11 +14,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - about - javascript - vbscript - process_name: mshta.exe + process.file.name: mshta.exe condition: (selection1) how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -44,34 +44,10 @@ tags: mitre_attack_id: - T1218.005 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml b/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml index 46fdafbbb8..d01ba7f3e0 100644 --- a/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -14,12 +14,12 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - '/f ' - '-f ' - process_name: odbcconf.exe + process.file.name: odbcconf.exe selection2: - process|contains: .rsp + process.cmd_line|contains: .rsp condition: (selection1) and selection2 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -41,30 +41,10 @@ tags: mitre_attack_id: - T1218.008 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 42 diff --git a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index d9524060d5..83e3c3e99c 100644 --- a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -20,11 +20,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: ntdsutil.exe + process.file.name: ntdsutil.exe selection2: - process|contains: create + process.cmd_line|contains: create selection3: - process|contains: ntds + process.cmd_line|contains: ntds condition: selection1 and (selection2 and selection3) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -50,30 +50,10 @@ tags: mitre_attack_id: - T1003.003 - T1003 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 50 diff --git a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index 6e8dbc3c3c..966e97129b 100644 --- a/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -19,14 +19,14 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - '-ma ' - '-mm ' - process_name: + process.file.name: - procdump64.exe - procdump.exe selection2: - process|contains: lsass + process.cmd_line|contains: lsass condition: (selection1) and selection2 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -49,30 +49,10 @@ tags: mitre_attack_id: - T1003.001 - T1003 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 461decb710..18f72a8e6a 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -18,7 +18,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - powershell_ise.exe - powershell.exe - sqltoolsps.exe @@ -26,7 +26,7 @@ search: - pwsh.exe - pwsh.exe selection2: - process|re: '(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]' + process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-] condition: selection1 and not selection2 how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -55,34 +55,10 @@ tags: $dest$ executed by user $user$. mitre_attack_id: - T1020 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 72cc1d8f85..1d2aa5c194 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. data_source: -- Windows Security 4688 +- Powershell 4104 search: selection1: - process|contains: '4194304' + process.cmd_line|contains: '4194304' selection2: - process|re: get-aduser + process.cmd_line|re: get-aduser condition: selection1 and selection2 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -40,22 +40,10 @@ tags: mitre_attack_id: - T1558 - T1558.004 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 54 diff --git a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 533c0fcefd..068614df85 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. data_source: -- Windows Security 4688 +- Powershell 4104 search: selection1: - process|re: preauthnotrequired + process.cmd_line|re: preauthnotrequired selection2: - process|re: get-domainuser + process.cmd_line|re: get-domainuser condition: selection1 and selection2 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -39,22 +39,10 @@ tags: mitre_attack_id: - T1558 - T1558.004 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 54 diff --git a/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml b/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml index 6afc3672f3..80e96ad37a 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml @@ -14,7 +14,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - powershell_ise.exe - powershell.exe - sqltoolsps.exe @@ -22,7 +22,7 @@ search: - pwsh.exe - pwsh.exe selection2: - process|re: downloadfile + process.cmd_line|re: downloadfile condition: selection1 and selection2 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -49,34 +49,10 @@ tags: within PowerShell. mitre_attack_id: - T1020 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 6787089bdb..a51846ed40 100644 --- a/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -16,7 +16,7 @@ data_source: - Windows Security 4688 search: selection1: - process_name: + process.file.name: - powershell_ise.exe - powershell.exe - sqltoolsps.exe @@ -24,7 +24,7 @@ search: - pwsh.exe - pwsh.exe selection2: - process|re: start-bitstransfer + process.cmd_line|re: start-bitstransfer condition: selection1 and selection2 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -47,34 +47,10 @@ tags: mitre_attack_id: - T1197 - T1105 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 49 diff --git a/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml b/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml index c41411a6c2..735a598ee2 100644 --- a/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -13,11 +13,11 @@ data_source: - Windows Security 4688 search: selection1: - process_name: rasautou.exe + process.file.name: rasautou.exe selection2: - process|re: '-p ' + process.cmd_line|re: '-p ' selection3: - process|re: '-d ' + process.cmd_line|re: '-d ' condition: selection1 and selection2 and selection3 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -44,34 +44,10 @@ tags: - T1055.001 - T1218 - T1055 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index add1c62e79..d307d17aae 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: acccheckconsole.exe + process.file.name: acccheckconsole.exe selection2: - process_path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker + process.file.path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 3376e1e527..9001580db0 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: adplus.exe + process.file.name: adplus.exe selection2: - process_path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86 + process.file.path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86 condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 218cd9b17c..03149cf023 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: advpack.dll + process.file.name: advpack.dll selection2: - process_path|re: \\windows\\syswow64 + process.file.path|re: \\windows\\syswow64 condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 81d9f2565b..827ab96c1d 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: agentexecutor.exe + process.file.name: agentexecutor.exe selection2: - process_path|re: \\program files (x86) + process.file.path|re: \\program files (x86) condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 3a0ef6ec50..54127cd35e 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: appinstaller.exe + process.file.name: appinstaller.exe selection2: - process_path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe + process.file.path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index b52ecbf386..2ccbde60a6 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: appvlp.exe + process.file.name: appvlp.exe selection2: - process_path|re: \\program files (x86)\\microsoft office\\root\\client + process.file.path|re: \\program files (x86)\\microsoft office\\root\\client condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index a1066310a4..c8c8c48b45 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: aspnet_compiler.exe + process.file.name: aspnet_compiler.exe selection2: - process_path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319 + process.file.path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319 condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 3f1a7387b2..bcef5c468f 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: at.exe + process.file.name: at.exe selection2: - process_path|re: \\windows\\syswow64 + process.file.path|re: \\windows\\syswow64 condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index 319f6f4ab6..a3ccebdf52 100644 --- a/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -13,9 +13,9 @@ data_source: - Windows Security 4688 search: selection1: - process_name: atbroker.exe + process.file.name: atbroker.exe selection2: - process_path|re: \\windows\\syswow64 + process.file.path|re: \\windows\\syswow64 condition: selection1 and not selection2 how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -39,23 +39,10 @@ tags: mitre_attack_id: - T1036 - T1036.003 - observable: - - name: dest_device_id - type: Hostname - role: - - Victim - - name: dest_user_id - type: User - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - dest_user_id - - process_path + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 14 diff --git a/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 60ba5207cc..583cb80a83 100644 --- a/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -12,10 +12,10 @@ data_source: - Windows Security 4688 search: selection1: - process|re: minidump - process_name: 'rundll32.exe' + process.cmd_line|re: minidump + process.file.name: rundll32.exe selection2: - process|re: comsvcs.dll + process.cmd_line|re: comsvcs.dll condition: selection1 and selection2 how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event @@ -37,23 +37,10 @@ tags: mitre_attack_id: - T1003.003 - T1003 - observable: - - name: dest_user_id - type: User - role: - - Actor - - name: dest_device_id - type: Hostname - role: - - Victim + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - process_name - - _tenant - - _time - - dest_device_id - - process + required_fields: [] kill_chain_phases: - Actions on Objectives risk_score: 40 diff --git a/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index b4430c71d2..92bb448f79 100644 --- a/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -16,11 +16,11 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - about - javascript - vbscript - process_name: rundll32.exe + process.file.name: rundll32.exe condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -45,34 +45,10 @@ tags: mitre_attack_id: - T1218 - T1218.005 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 56 diff --git a/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml index 8542e31834..099f73ff07 100644 --- a/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -15,10 +15,10 @@ data_source: - Windows Security 4688 search: selection1: - process_name: MSBuild.exe - parent_process_name|re: - - 'cscript.exe' - - 'wscript.exe' + process.file.name: MSBuild.exe + actor.process.file.name|re: + - cscript.exe + - wscript.exe condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -42,34 +42,10 @@ tags: mitre_attack_id: - T1127.001 - T1127 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 19505f2073..f6c6d7cd53 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -15,8 +15,8 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: -decompile - process_name: hh.exe + process.cmd_line|contains: -decompile + process.file.name: hh.exe condition: selection1 how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -40,30 +40,10 @@ tags: mitre_attack_id: - T1218.001 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 90 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 3ad833476c..02b64e9873 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -20,10 +20,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - https:// - http:// - process_name: hh.exe + process.file.name: hh.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -50,30 +50,10 @@ tags: mitre_attack_id: - T1218.001 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 90 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index cd52df92ec..13828e0f28 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -23,10 +23,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - 'mk:@MSITStore:' - 'its:' - process_name: hh.exe + process.file.name: hh.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -53,30 +53,10 @@ tags: mitre_attack_id: - T1218.001 - T1218 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 72 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index f130c5b4bc..69582e4148 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -12,10 +12,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - '-y ' - '/y ' - process_name: msiexec.exe + process.file.name: msiexec.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -36,30 +36,10 @@ tags: by user $dest_user_id$ attempting to register a file. mitre_attack_id: - T1218.007 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 9347dc19ce..d68331f523 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -12,10 +12,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - https:// - http:// - process_name: msiexec.exe + process.file.name: msiexec.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -36,30 +36,10 @@ tags: by user $dest_user_id$ attempting to download a file. mitre_attack_id: - T1218.007 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index d547f67527..091f8ae8ae 100644 --- a/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -12,10 +12,10 @@ data_source: - Windows Security 4688 search: selection1: - process|contains: + process.cmd_line|contains: - '-z ' - '/z ' - process_name: msiexec.exe + process.file.name: msiexec.exe condition: (selection1) how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -36,30 +36,10 @@ tags: by user $dest_user_id$ attempting to unregister a DLL. mitre_attack_id: - T1218.007 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index bebfa66a8b..303f5422ac 100644 --- a/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -16,8 +16,8 @@ data_source: - Windows Security 4688 search: selection1: - process_name: MSBuild.exe - parent_process_name|re: wmiprvse.exe + process.file.name: MSBuild.exe + actor.process.file.name|re: wmiprvse.exe condition: selection1 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -41,34 +41,10 @@ tags: mitre_attack_id: - T1127 - T1127.001 - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process + observable: [] product: - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - process + required_fields: [] kill_chain_phases: - Exploitation risk_score: 80 diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index a8f35bf5e5..89a9d006aa 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -11,18 +11,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, - "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name, - "%cmd.exe")) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") + OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") + OR like(actor_process_file_name, "%cmd.exe")) | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -59,11 +59,15 @@ references: - https://attack.mitre.org/techniques/T1560/001/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint risk_severity: low @@ -78,7 +82,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml index 1f4755a9a7..a67dfcb554 100644 --- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml @@ -14,16 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") + | eval body=create_map( "devices", [ create_map( @@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -62,10 +63,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 36 security_domain: endpoint risk_severity: low @@ -80,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml index 6be77789b3..0babd2c2c8 100644 --- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml +++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml @@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND - process_file_name="sc.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") + AND process_file_name="sc.exe" | eval body=create_map( "devices", [ create_map( @@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,10 +64,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 36 security_domain: endpoint risk_severity: low @@ -82,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index a6bb3e54ff..ddc458e504 100644 --- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,10 +64,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint risk_severity: medium @@ -82,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml index 5bcab2aa50..572eba26b4 100644 --- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml +++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml @@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line, - "%recoveryenabled%")) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") + AND like(process_cmd_line, "%recoveryenabled%")) | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -58,10 +58,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -76,7 +81,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml index ead234e3be..0769a93a6c 100644 --- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") + | eval body=create_map( "devices", [ create_map( @@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -58,10 +59,15 @@ references: - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint risk_severity: high @@ -76,7 +82,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml index cb976fc39c..0b3d0bf55f 100644 --- a/dist/ssa/srs/ssa___delete_a_net_user.yml +++ b/dist/ssa/srs/ssa___delete_a_net_user.yml @@ -15,17 +15,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe" - OR process_file_name="net1.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") + AND (process_file_name="net.exe" OR process_file_name="net1.exe") | eval body=create_map( "devices", [ create_map( @@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,10 +63,15 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -81,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml index 4069d3583e..f90ed068db 100644 --- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml @@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true + | eval body=create_map( "devices", [ create_map( @@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +62,15 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -79,7 +85,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index d8c592d0c6..1b1cde45ee 100644 --- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -13,18 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR - actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR - actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" + OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" + OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" @@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +65,15 @@ references: - https://attack.mitre.org/techniques/T1059/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path + - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -83,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml index e0e9f0b456..c1862cc5bb 100644 --- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml +++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml @@ -16,21 +16,22 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%") - OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%") - OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line, - "%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line, - "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%") - OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, + "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, + "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR + like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR + like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, + "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" + | eval body=create_map( "devices", [ create_map( @@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -70,10 +71,15 @@ references: - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -88,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml index 12848a06f2..a96f5a9195 100644 --- a/dist/ssa/srs/ssa___disable_net_user_account.yml +++ b/dist/ssa/srs/ssa___disable_net_user_account.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND - (process_file_name="net.exe" OR process_file_name="net1.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") + AND (process_file_name="net.exe" OR process_file_name="net1.exe") | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -62,10 +62,15 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -80,7 +85,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml index 443b254f67..e02d07c982 100644 --- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml @@ -15,18 +15,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line, - "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%")) - AND process_file_name="nslookup.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") + OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, + "%-querytype=%")) AND process_file_name="nslookup.exe" | eval body=create_map( "devices", [ create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +65,15 @@ references: - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint risk_severity: medium @@ -83,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml index 4c6f406682..f50eaf9a35 100644 --- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml +++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml @@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" + | eval body=create_map( "devices", [ create_map( @@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -60,10 +61,15 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 54 security_domain: endpoint risk_severity: medium @@ -78,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml index 91b48b9646..fc32e7bda4 100644 --- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml +++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml @@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true + | eval body=create_map( "devices", [ create_map( @@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +62,15 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -79,7 +85,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml index c0b507473d..44ab76c288 100644 --- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -13,16 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true + | eval body=create_map( "devices", [ create_map( @@ -30,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +62,15 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint risk_severity: medium @@ -79,7 +85,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml index af65195e3d..abc8311a20 100644 --- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml @@ -15,16 +15,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") @@ -35,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +65,15 @@ references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -83,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml index 717e9de6d2..2cbbcefe1b 100644 --- a/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml +++ b/dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml @@ -12,20 +12,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") + AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - + /(?i)winword.exe/)=true) | eval body=create_map( "devices", [ create_map( @@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint risk_severity: medium @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml index 45708f0a0d..3e2d5a8bb6 100644 --- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml +++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml @@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%") - AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, + "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" + | eval body=create_map( "devices", [ create_map( @@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -62,10 +63,15 @@ references: - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 64 security_domain: endpoint risk_severity: medium @@ -80,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml index be9a096f35..aa26c33862 100644 --- a/dist/ssa/srs/ssa___sdelete_application_execution.yml +++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml @@ -14,27 +14,27 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line, - "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%") - OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line, - "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%") - OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line, - "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%") - OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line, - "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%") - OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line, - "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR - like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name, - "%sdelete%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") + OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, + "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") + OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, + "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") + OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, + "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") + OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR + like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, + "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR + like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, + "%-c %")) AND like(process_file_name, "%sdelete%") | eval body=create_map( "devices", [ create_map( @@ -42,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -73,10 +73,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint risk_severity: low @@ -91,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml index 341e1e6f9a..5c322f21b6 100644 --- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml +++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml @@ -1,11 +1,11 @@ name: System Process Running from Unexpected Location id: 28179107-099a-464a-94d3-08301e6c055f -version: 5 -description: An attacker might try to use a different version of a system command - without overriding the original, or they might try to avoid some detections by running - the process from a different folder. This detection checks that a list of system - processes are run inside C:\\Windows\System32 or C:\\Windows\SysWOW64. The list - of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv +version: 4 +description: An attacker tries might try to use different version of a system command + without overriding original, or they might try to avoid some detection running the + process from a different folder. This detection checks that a list of system processes + run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes + has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", @@ -15,64 +15,64 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" - OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" - OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" - OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe" - OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" - OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" - OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" - OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" - OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" - OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" - OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe" - OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" - OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" - OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" - OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" - OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe" - OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" - OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" - OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" - OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" - OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" - OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" - OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" - OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR - process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe" - OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe" - OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe" - OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe" - OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe" - OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe" - OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe" - OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe" - OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe" - OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe" - OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe" - OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe" - OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe" - OR process_file_name="rmttpmvscmgrsvr.exe" OR process_file_name="resmon.exe" OR - process_file_name="reset.exe" OR process_file_name="replace.exe" OR process_file_name="repair-bde.exe" - OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" OR process_file_name="regsvr32.exe" - OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" OR process_file_name="reg.exe" - OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" OR process_file_name="rdrleakdiag.exe" - OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" OR process_file_name="rasphone.exe" - OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" OR process_file_name="rasautou.exe" - OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" OR process_file_name="query.exe" - OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" OR process_file_name="pwlauncher.exe" - OR process_file_name="psr.exe" OR process_file_name="provtool.exe" OR process_file_name="proquota.exe" - OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" + OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" + OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" + OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" + OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" + OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" + OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" + OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" + OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" + OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" + OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" + OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" + OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" + OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" + OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" + OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" + OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" + OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" + OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" + OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" + OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR + process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" + OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" + OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" + OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" + OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" + OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" + OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" + OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" + OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" + OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" + OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" + OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" + OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" + OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" + OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" + OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" + OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" + OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe" + OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe" + OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" + OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" + OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" + OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" + OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" + OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" + OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" + OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe" + OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe" OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe" OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe" OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe" @@ -243,11 +243,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -268,11 +268,15 @@ known_false_positives: None references: [] tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint risk_severity: medium @@ -287,7 +291,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml index ea9d703b0f..1a22c44bfb 100644 --- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml +++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml @@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) | eval body=create_map( "devices", [ @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +61,15 @@ references: - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 15 security_domain: endpoint risk_severity: low @@ -79,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml index 1eb0a3d36f..a74aa387f6 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml @@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" @@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,10 +64,15 @@ references: - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint risk_severity: medium @@ -82,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml index 74ff22bd8f..423c110ccc 100644 --- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml +++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml @@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe" - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% + sl %") AND process_file_name="wevtutil.exe" | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +61,15 @@ references: - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint risk_severity: medium @@ -79,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml index af82a09ef4..d810c3e4e5 100644 --- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml +++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml @@ -16,16 +16,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" @@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -71,10 +71,15 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint risk_severity: medium @@ -89,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml index 67cff59e4f..8ef9fa0746 100644 --- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml +++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml @@ -21,16 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" + | eval body=create_map( "devices", [ create_map( @@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -72,10 +73,15 @@ references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -90,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml index bc9511a0fa..67fd722158 100644 --- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml +++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml @@ -17,16 +17,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" + | eval body=create_map( "devices", [ create_map( @@ -34,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -69,10 +70,15 @@ references: - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 40 security_domain: endpoint risk_severity: low @@ -87,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml index 50af9938b7..fd8dacebe4 100644 --- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml @@ -16,17 +16,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, - "%urlcache%")) OR like(process_cmd_line, "%urlcache%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") + AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") + | eval body=create_map( "devices", [ create_map( @@ -34,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows CertUtil URLCache Download has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows CertUtil URLCache Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +66,15 @@ references: - https://web.archive.org/web/20210921110637/https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint risk_severity: high @@ -83,7 +89,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml index 191891cb14..9c70a807aa 100644 --- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml +++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml @@ -16,17 +16,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, - "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") + AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") + | eval body=create_map( "devices", [ create_map( @@ -34,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows CertUtil VerifyCtl Download has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows CertUtil VerifyCtl Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -66,10 +67,15 @@ references: - https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint risk_severity: high @@ -84,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml index 957f684826..b3669571d7 100644 --- a/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/dist/ssa/srs/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -17,16 +17,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" | eval body=create_map( "devices", [ @@ -35,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows COM Hijacking InprocServer32 Modification has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows COM Hijacking InprocServer32 Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -66,10 +66,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 64 security_domain: endpoint risk_severity: medium @@ -84,7 +89,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml index bcf7b5da3e..744e04b56e 100644 --- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml +++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml @@ -27,18 +27,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data %") OR like(process_cmd_line, - "%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line, - "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data + %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file + %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true + | eval body=create_map( "devices", [ create_map( @@ -46,11 +47,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Curl Upload to Remote Destination has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Curl Upload to Remote Destination has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -77,10 +78,15 @@ references: - https://twitter.com/d1r4c/status/1279042657508081664?s=20 tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -95,7 +101,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml index 4b739734f1..0c999d0876 100644 --- a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml @@ -11,16 +11,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) | eval body=create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Defender Tools in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Defender Tools in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -57,11 +57,15 @@ references: - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint risk_severity: medium @@ -76,7 +80,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml index 2e3b0702a7..ef37944b3c 100644 --- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml +++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml @@ -15,17 +15,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe" - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) + AND process_file_name="diskshadow.exe" | eval body=create_map( "devices", [ create_map( @@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Diskshadow Proxy Execution has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Diskshadow Proxy Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -62,10 +62,15 @@ references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -80,7 +85,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml index fe84e5177b..86312ce4bd 100644 --- a/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -15,16 +15,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true @@ -65,11 +65,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows DotNet Binary in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows DotNet Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -96,11 +96,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -115,7 +119,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml index 37344c0bae..3f20f3aaf5 100644 --- a/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml +++ b/dist/ssa/srs/ssa___windows_exchange_powershell_module_usage.yml @@ -26,23 +26,17 @@ description: 'The following analytic identifies the usage of Exchange PowerShell search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true + OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxexportrequest/)=true | eval body=create_map( "devices", [ create_map( @@ -50,11 +44,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line), - "message", concat("Windows Exchange PowerShell Module Usage has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), + "message", concat("Windows Exchange PowerShell Module Usage has been triggered on ", device_hostname, " by ", "Unknown", "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -87,33 +81,27 @@ references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ tags: required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 32 security_domain: endpoint risk_severity: low research_site_url: https://research.splunk.com/endpoint/1118bc65-b0c7-4589-bc2f-ad6802fd0909/ event_schema: ocsf mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id annotations: analytic_story: - ProxyShell diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 875fa5d7cd..c1f2034cd3 100644 --- a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -14,21 +14,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:-id%") - OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:%") - OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, - /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true - OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, - /(?i)pcwdiagnostic/)=true + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, + "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, + "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") + AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, + /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) + AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true | eval body=create_map( "devices", [ create_map( @@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Execute Arbitrary Commands with MSDT has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Execute Arbitrary Commands with MSDT has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -71,10 +71,15 @@ references: - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 100 security_domain: endpoint risk_severity: high @@ -89,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml index 4fd14e725d..caca8f71f3 100644 --- a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -17,17 +17,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="explorer.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="explorer.exe" | eval body=create_map( "devices", [ create_map( @@ -35,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Ingress Tool Transfer Using Explorer has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Ingress Tool Transfer Using Explorer has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,10 +64,15 @@ references: - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 25 security_domain: endpoint risk_severity: low @@ -82,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml index aaa8e88e3b..4939a389eb 100644 --- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -14,18 +14,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" - OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" - OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" + OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" + OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" @@ -64,11 +64,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows LOLBin Binary in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows LOLBin Binary in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -95,11 +95,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -114,7 +118,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml index 0da2a3330d..04027d661a 100644 --- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml +++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml @@ -13,20 +13,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe" - OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" - OR process_file_name="powershell.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" + OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" + OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" + OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, + "%mshta.exe") | eval body=create_map( "devices", [ create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Windows MSHTA Child Process has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows MSHTA Child Process has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,11 +65,15 @@ references: - https://redcanary.com/blog/introducing-atomictestharnesses/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -84,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml index c5720dcdb3..88c567faca 100644 --- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml +++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml @@ -16,17 +16,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="mshta.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="mshta.exe" | eval body=create_map( "devices", [ create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows MSHTA Command-Line URL has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows MSHTA Command-Line URL has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -67,10 +67,15 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -85,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml index 1a12a7b55f..bfe0659b88 100644 --- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml @@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR - like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") + OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" | eval body=create_map( "devices", [ create_map( @@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows MSHTA Inline HTA Execution has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows MSHTA Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +65,15 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -83,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml index c6c9157fef..060d41f55b 100644 --- a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml +++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml @@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe") - AND like(process_cmd_line, "%.rsp%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) + AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") | eval body=create_map( "devices", [ create_map( @@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Odbcconf Load Response File has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Odbcconf Load Response File has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,10 +63,15 @@ references: - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint risk_severity: low @@ -81,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 131e8e8353..c46df3acbb 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line, - "%ntds%")) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") + AND like(process_cmd_line, "%ntds%")) | eval body=create_map( "devices", [ create_map( @@ -38,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows OS Credential Dumping with Ntdsutil Export NTDS has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -71,10 +71,15 @@ references: - https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 50 security_domain: endpoint risk_severity: medium @@ -89,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml index a060ffd09b..82ac46545c 100644 --- a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml @@ -19,17 +19,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe" - OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm + %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND like(process_cmd_line, "%lsass%") | eval body=create_map( "devices", [ create_map( @@ -37,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows OS Credential Dumping with Procdump has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows OS Credential Dumping with Procdump has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -69,10 +70,15 @@ references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -87,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index 0582ce491c..068536e43c 100644 --- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true) | eval body=create_map( @@ -38,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Powershell Connect to Internet With Hidden Window has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Powershell Connect to Internet With Hidden Window has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -73,10 +73,15 @@ references: - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -91,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index af33d67551..736e0b05da 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -12,22 +12,15 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true - + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, + "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true | eval body=create_map( "devices", [ create_map( @@ -35,11 +28,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), + "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery Get-ADUser has been triggered on ", device_hostname, " by ", "Unknown", "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -66,33 +59,27 @@ references: - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ tags: required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 54 security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/d57b4d91-fc91-4482-a325-47693cced1eb/ event_schema: ocsf mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id annotations: analytic_story: - Active Directory Kerberos Attacks diff --git a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 68afa08ab7..d7f5a99b1e 100644 --- a/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/dist/ssa/srs/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -12,22 +12,16 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, - /(?i)get-domainuser/)=true + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true + | eval body=create_map( "devices", [ create_map( @@ -35,11 +29,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line), - "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("device.hostname", device_hostname, "process.file.path", process_file_path, "process.uid", process_uid, "process.cmd_line", process_cmd_line, "actor.user.uid", actor_user_uid), + "message", concat("Windows PowerShell Disabled Kerberos Pre-Authentication Discovery With PowerView has been triggered on ", device_hostname, " by ", "Unknown", "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", "Unknown", "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,33 +59,27 @@ references: - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/ tags: required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 54 security_domain: endpoint risk_severity: medium research_site_url: https://research.splunk.com/endpoint/dc3f2af7-ca69-47ce-a122-9f9787e19417/ event_schema: ocsf mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id annotations: analytic_story: - Active Directory Kerberos Attacks diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml index 8e7b5cc92b..4b899f2c9b 100644 --- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml +++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml @@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true | eval body=create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Powershell DownloadFile has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Powershell DownloadFile has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -68,10 +68,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -86,7 +91,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml index b1acdea51b..176bfc055a 100644 --- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml +++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml @@ -16,17 +16,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true | eval body=create_map( @@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows PowerShell Start-BitsTransfer has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows PowerShell Start-BitsTransfer has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -67,10 +67,15 @@ references: - https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint risk_severity: low @@ -85,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml index ae18ccf3d4..21cca3f8fc 100644 --- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml +++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true - AND match_regex(process_cmd_line, /(?i)-d /)=true + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, + /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rasautou DLL Execution has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rasautou DLL Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,10 +65,15 @@ references: - https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -83,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index f5cd6303d7..16da05f0aa 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -13,16 +13,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) | eval body=create_map( @@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Acccheckconsole exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,11 +64,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -83,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index 3e49c96d02..5bce274dce 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)\\windows kits\\10\\debuggers\\x86/)=true) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Adplus exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index 8558046a70..ecd69422fa 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Advpack dll LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index b0494f4e1b..8d5b573a57 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)/)=true) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Agentexecutor exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index 7c24a90c74..3f93be3ac8 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) | eval body=create_map( "devices", [ @@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Appinstaller exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,11 +64,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -83,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index f10b6ff95b..7b0d5af043 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)\\microsoft office\\root\\client/)=true) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Appvlp exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index dca1b83c59..f42875000d 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -13,16 +13,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) | eval body=create_map( "devices", [ @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Aspnet compiler exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 88ba4c4f38..ebd4dbec13 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities At exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index e1a3b63c97..857dc390ee 100644 --- a/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/dist/ssa/srs/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) | eval body=create_map( "devices", [ create_map( @@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rename System Utilities Atbroker exe LOLBAS in Non Standard Path has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -63,11 +63,15 @@ references: - https://lolbas-project.github.io/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint risk_severity: low @@ -82,7 +86,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml index dbbc9875eb..1a2d458cc2 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true | eval body=create_map( "devices", [ @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rundll32 Comsvcs Memory Dump has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rundll32 Comsvcs Memory Dump has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -60,10 +60,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 40 security_domain: endpoint risk_severity: low @@ -78,7 +83,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml index 4694198040..ab4d55d262 100644 --- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml +++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml @@ -16,17 +16,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR - like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") + OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" | eval body=create_map( "devices", [ create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows Rundll32 Inline HTA Execution has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Rundll32 Inline HTA Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -67,10 +67,15 @@ references: - https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint risk_severity: medium @@ -85,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml index 304c27502b..1024255a57 100644 --- a/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml @@ -15,17 +15,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, - /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, + /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) + | eval body=create_map( "devices", [ create_map( @@ -33,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Windows Script Host Spawn MSBuild has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows Script Host Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -65,11 +66,15 @@ references: - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1127.001_MSBuild/InvokeMSBuild.ps1 tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -84,7 +89,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 8a68654a4a..1a299b5c7c 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -15,16 +15,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" + | eval body=create_map( "devices", [ create_map( @@ -32,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution Compiled HTML File Decompile has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -64,10 +65,15 @@ references: - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint risk_severity: high @@ -82,7 +88,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 027968fb17..51024955d7 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="hh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="hh.exe" | eval body=create_map( "devices", [ create_map( @@ -38,11 +38,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution Compiled HTML File URL In Command Line has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -73,10 +73,15 @@ references: - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint risk_severity: high @@ -91,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 799d39b190..f2a788c237 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -23,17 +23,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%")) - AND process_file_name="hh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, + "%its:%")) AND process_file_name="hh.exe" | eval body=create_map( "devices", [ create_map( @@ -41,11 +41,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -76,10 +76,15 @@ references: - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint risk_severity: medium @@ -94,7 +99,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 600a6abe04..473f111800 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe" - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) + AND process_file_name="msiexec.exe" | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution MSIExec DLLRegisterServer has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +61,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -79,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index 5c02191372..0b7212880c 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="msiexec.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="msiexec.exe" | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution MSIExec Remote Download has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +61,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -79,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index 35a06f642c..f51b95cf5a 100644 --- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe" - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) + AND process_file_name="msiexec.exe" | eval body=create_map( "devices", [ create_map( @@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line), - "message", concat("Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows System Binary Proxy Execution MSIExec Unregister DLL has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -61,10 +61,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint risk_severity: low @@ -79,7 +84,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml index aa0891f6aa..701db02b7c 100644 --- a/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -16,17 +16,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe" - + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, + /(?i)wmiprvse.exe/)=true | eval body=create_map( "devices", [ create_map( @@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu ) ], "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "message", concat("Windows WMIPrvse Spawn MSBuild has been triggered on ", device_hostname, " by ", process_user_name, "."), + "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname), + "message", concat("Windows WMIPrvse Spawn MSBuild has been triggered on ", device_hostname, " by ", actor_user_name, "."), "users", [ create_map( - "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null) + "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null) ) ], "activity_id", 1, @@ -66,11 +66,15 @@ references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md tags: required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint risk_severity: high @@ -85,7 +89,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml index d6c8203ca9..7bda2abc32 100644 --- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml +++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml @@ -17,18 +17,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, - "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name, - "%cmd.exe")) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") + OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") + OR like(actor_process_file_name, "%cmd.exe")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -51,24 +51,36 @@ tags: - T1560.001 - T1560 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint mappings: @@ -80,7 +92,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml index d73f06402a..cb2b668a3f 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml @@ -20,16 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -53,21 +54,36 @@ tags: - T1543 - T1543.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 36 security_domain: endpoint mappings: @@ -79,7 +95,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml index d95a95130a..358274fd08 100644 --- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND - process_file_name="sc.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") + AND process_file_name="sc.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -53,21 +53,36 @@ tags: mitre_attack_id: - T1489 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 36 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index c1e7fe8888..8c03c1170b 100644 --- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -18,16 +18,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true @@ -53,21 +53,36 @@ tags: - T1003 - T1003.002 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml index aed9478fc7..10067381ed 100644 --- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml +++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line, - "%recoveryenabled%")) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") + AND like(process_cmd_line, "%recoveryenabled%")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -49,21 +49,36 @@ tags: mitre_attack_id: - T1490 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -75,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml index a67836a032..4d6abb2fb4 100644 --- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml +++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml @@ -18,16 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -49,21 +50,36 @@ tags: - T1070.004 - T1070 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint mappings: @@ -75,7 +91,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml index 02954b3727..0b7efb37b6 100644 --- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml +++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml @@ -21,17 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe" - OR process_file_name="net1.exe") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") + AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -53,21 +53,36 @@ tags: mitre_attack_id: - T1531 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index a92112b9e0..bd18dc381d 100644 --- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -19,17 +19,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -50,21 +51,36 @@ tags: mitre_attack_id: - T1222 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -76,7 +92,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index c25476465e..ebec5b0d61 100644 --- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -19,18 +19,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR - actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR - actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" + OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" + OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe" OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe" OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe" AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe" @@ -55,21 +55,36 @@ tags: mitre_attack_id: - T1059 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File + - name: process.file.name + type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path + - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -81,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml index 4199c80766..74ecbde3b8 100644 --- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml +++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml @@ -22,21 +22,22 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%") - OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%") - OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line, - "%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line, - "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%") - OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, + "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, + "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR + like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR + like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, + "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -61,21 +62,36 @@ tags: mitre_attack_id: - T1020 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -87,7 +103,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml index 262a740c35..1af618919e 100644 --- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml +++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND - (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") + AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -52,21 +52,36 @@ tags: - T1489 - T1078 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -78,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml index 7cf489927d..479110d105 100644 --- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml +++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml @@ -21,18 +21,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line, - "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%")) - AND process_file_name="nslookup.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") + OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, + "%-querytype=%")) AND process_file_name="nslookup.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -57,21 +57,36 @@ tags: mitre_attack_id: - T1048 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint mappings: @@ -83,7 +98,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml index 0eb63b24fe..f4c6e3fa0d 100644 --- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml +++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml @@ -18,16 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -51,21 +52,36 @@ tags: mitre_attack_id: - T1070 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 54 security_domain: endpoint mappings: @@ -77,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index a1c322a46d..aec2f7bbb0 100644 --- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -19,17 +19,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe" - OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" + OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -50,21 +51,36 @@ tags: mitre_attack_id: - T1222 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -76,7 +92,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml index bb0c437e60..559e5078c7 100644 --- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml +++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml @@ -19,16 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true + --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -52,21 +53,36 @@ tags: - T1222.001 - T1222 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint mappings: @@ -78,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index b5431f655a..56be05c9ba 100644 --- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -21,16 +21,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line, /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--' @@ -53,21 +53,36 @@ tags: mitre_attack_id: - T1222 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml index 8df9bf6dca..22fa4abe4d 100644 --- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml +++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml @@ -18,20 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe") + AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, - /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe") - --finding_report--' + /(?i)winword.exe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -52,24 +52,36 @@ tags: - T1566 - T1566.001 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint mappings: @@ -81,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml index 0332f16c00..14e8a6f7c5 100644 --- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -19,17 +19,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%") - AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, + "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -52,21 +53,36 @@ tags: mitre_attack_id: - T1489 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 64 security_domain: endpoint mappings: @@ -78,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml index c196b01c70..0db0a277f5 100644 --- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml +++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml @@ -20,27 +20,27 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line, - "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%") - OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line, - "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%") - OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line, - "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%") - OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line, - "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%") - OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line, - "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR - like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name, - "%sdelete%") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") + OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, + "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") + OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, + "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") + OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, + "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") + OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR + like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, + "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR + like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line, + "%-c %")) AND like(process_file_name, "%sdelete%") --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -64,21 +64,36 @@ tags: - T1070.004 - T1070 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint mappings: @@ -90,7 +105,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml index 36c6839052..4782fdb7f9 100644 --- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml +++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml @@ -1,11 +1,16 @@ name: System Process Running from Unexpected Location id: 28179107-099a-464a-94d3-08301e6c055f -version: 5 +version: 4 date: '2022-03-24' -author: Jose Hernandez, Ignacio Bermudez Corrales, Splunk +author: Jose Hernadnez, Ignacio Bermudez Corrales, Splunk type: Anomaly status: production -description: An attacker might try to use a different version of a system command without overriding the original, or they might try to avoid some detections by running the process from a different folder. This detection checks that a list of system processes are run inside C:\\Windows\System32 or C:\\Windows\SysWOW64. The list of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml +description: An attacker tries might try to use different version of a system command + without overriding original, or they might try to avoid some detection running the + process from a different folder. This detection checks that a list of system processes + run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes + has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv + and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml data_source: - Windows Security 4688 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", @@ -16,47 +21,47 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe" - OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe" - OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe" - OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe" - OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe" - OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe" - OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe" - OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe" - OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe" - OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe" - OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe" - OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe" - OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe" - OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe" - OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe" - OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe" - OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe" - OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe" - OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe" - OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe" - OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" - OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" - OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" - OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" - OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR - process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe" - OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe" - OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe" - OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe" - OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe" - OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe" - OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" + OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" + OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" + OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe" + OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" + OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" + OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" + OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" + OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe" + OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" + OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe" + OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" + OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" + OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" + OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" + OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" + OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" + OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" + OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" + OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" + OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR + process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe" + OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe" + OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe" + OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe" + OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" + OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" + OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" + OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" + OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe" + OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" + OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" @@ -252,24 +257,36 @@ tags: mitre_attack_id: - T1036 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint mappings: @@ -281,7 +298,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml index 9194e994ed..57350b2a5f 100644 --- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml +++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml @@ -18,16 +18,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%") OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -51,21 +51,36 @@ tags: mitre_attack_id: - T1490 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 15 security_domain: endpoint mappings: @@ -77,7 +92,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index 5773e9e126..e3188eeac6 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -18,16 +18,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line, /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line, /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line, /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe" @@ -57,21 +57,36 @@ tags: - T1070 - T1070.001 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint mappings: @@ -83,7 +98,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index c12b29c579..8309897e63 100644 --- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe" - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% + sl %") AND process_file_name="wevtutil.exe" --finding_report--' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -53,21 +53,36 @@ tags: - T1070 - T1070.001 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 63 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml index a24ae0f8ac..477e43b714 100644 --- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml +++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml @@ -22,16 +22,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%") OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%") OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%") OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" --finding_report--' @@ -60,21 +60,36 @@ tags: mitre_attack_id: - T1197 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint mappings: @@ -86,7 +101,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml index d3bc359c7a..580df7e9ec 100644 --- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml +++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml @@ -27,16 +27,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -64,21 +65,36 @@ tags: - T1197 - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -90,7 +106,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml index 3eff69e316..4b5caa023a 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml @@ -23,16 +23,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -59,21 +60,36 @@ tags: mitre_attack_id: - T1140 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 40 security_domain: endpoint mappings: @@ -85,7 +101,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml index 5d9b310add..c4804364a8 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml @@ -22,17 +22,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, - "%urlcache%")) OR like(process_cmd_line, "%urlcache%") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") + AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%") + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -55,21 +56,36 @@ tags: mitre_attack_id: - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint mappings: @@ -81,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml index bb2a18e6b6..be0dcadd4a 100644 --- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml +++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml @@ -22,17 +22,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line, - "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") + AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -56,21 +57,36 @@ tags: mitre_attack_id: - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint mappings: @@ -82,7 +98,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml index d58c88722a..1e1801b118 100644 --- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml +++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml @@ -23,16 +23,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -55,21 +55,36 @@ tags: - T1546.015 - T1546 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 64 security_domain: endpoint mappings: @@ -81,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index fd711ddc32..0eef7c072c 100644 --- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -33,18 +33,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data %") OR like(process_cmd_line, - "%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line, - "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data + %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file + %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -67,21 +68,36 @@ tags: mitre_attack_id: - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -93,7 +109,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml index e87347ce79..68f28a13d9 100644 --- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml @@ -17,16 +17,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path, /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows defender\\platform/)=true) --finding_report--' how_to_implement: Collect endpoint data such as sysmon or 4688 events. @@ -46,24 +46,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint mappings: @@ -75,7 +87,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml index 5248dfcf9d..ea66adef4d 100644 --- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml @@ -21,17 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe" - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) + AND process_file_name="diskshadow.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel. @@ -50,21 +50,36 @@ tags: mitre_attack_id: - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -76,7 +91,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml index e6fe86d551..6ef87c5781 100644 --- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml @@ -21,16 +21,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name, /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name, /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true @@ -91,24 +91,36 @@ tags: - T1218 - T1218.004 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -120,7 +132,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml index 75eb0247d8..54989536c3 100644 --- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml +++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml @@ -28,27 +28,21 @@ description: 'The following analytic identifies the usage of Exchange PowerShell This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).' data_source: -- Windows Security 4688 +- Powershell 4104 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line, - /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true - OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--' + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)get-recipient/)=true OR match_regex(process_cmd_line, /(?i)new-mailboxsearch/)=true + OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true OR match_regex(process_cmd_line, + /(?i)new-mailboxexportrequest/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -76,39 +70,37 @@ tags: - T1059 - T1059.001 observable: - - name: process.user.name - type: User Name - name: device.hostname type: Hostname + - name: process.file.path + type: File + - name: process.uid + type: Other - name: process.cmd_line type: Other + - name: actor.user.uid + type: Other product: - Splunk Behavioral Analytics required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 32 security_domain: endpoint mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id tests: - name: True Positive Test attack_data: diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml index 0420f71c20..4e22c110a1 100644 --- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml +++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml @@ -20,21 +20,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:-id%") - OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:%") - OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line, - /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true - OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line, - /(?i)pcwdiagnostic/)=true --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, + "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, + "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") + AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line, + /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) + AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -59,21 +59,36 @@ tags: mitre_attack_id: - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 100 security_domain: endpoint mappings: @@ -85,7 +100,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml index 5dbd804468..19b0ead9d5 100644 --- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml +++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml @@ -23,17 +23,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="explorer.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="explorer.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints. @@ -53,21 +53,36 @@ tags: mitre_attack_id: - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 25 security_domain: endpoint mappings: @@ -79,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml index cd58ac59cb..54af1e4cce 100644 --- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml @@ -20,18 +20,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="certreq.exe" - OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe" - OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" + OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" + OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe" OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe" OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe" @@ -88,24 +88,36 @@ tags: - T1218 - T1218.004 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -117,7 +129,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml index 7f3bd7a419..f37120c357 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml @@ -19,20 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe" - OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe" - OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe" - OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe" - OR process_file_name="powershell.exe") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe" + OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe" + OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" + OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name, + "%mshta.exe") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -56,24 +56,36 @@ tags: - T1218.005 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -85,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml index ffb3eae23a..05cf77767c 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml @@ -22,17 +22,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="mshta.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -58,21 +58,36 @@ tags: - T1218.005 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -84,7 +99,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml index 5a30c411af..596fb1de8c 100644 --- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR - like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") + OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -56,21 +56,36 @@ tags: - T1218.005 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -82,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml index 1ceac50e5b..cf48c2debf 100644 --- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml +++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe") - AND like(process_cmd_line, "%.rsp%") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) + AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -52,21 +52,36 @@ tags: - T1218.008 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 42 security_domain: endpoint mappings: @@ -78,7 +93,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml index 63d0fa2093..0f995ae31b 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml @@ -26,17 +26,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line, - "%ntds%")) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") + AND like(process_cmd_line, "%ntds%")) --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -62,21 +62,36 @@ tags: - T1003.003 - T1003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 50 security_domain: endpoint mappings: @@ -88,7 +103,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml index b56a254a5a..29f8863b1b 100644 --- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml +++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml @@ -25,17 +25,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe" - OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm + %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe")) + AND like(process_cmd_line, "%lsass%") --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -58,21 +59,36 @@ tags: - T1003.001 - T1003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -84,7 +100,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml index d29c0618ce..03dd5fb9a6 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml @@ -24,17 +24,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true) --finding_report--' how_to_implement: You must be ingesting data that records process activity from your @@ -65,21 +65,36 @@ tags: mitre_attack_id: - T1020 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -91,7 +106,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml index 6ddde6d0a0..d161cbe9ff 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml @@ -14,26 +14,19 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline. data_source: -- Windows Security 4688 +- Powershell 4104 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true - --finding_report--' + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where like(process_cmd_line, + "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -54,39 +47,37 @@ tags: - T1558 - T1558.004 observable: - - name: process.user.name - type: User Name - name: device.hostname type: Hostname + - name: process.file.path + type: File + - name: process.uid + type: Other - name: process.cmd_line type: Other + - name: actor.user.uid + type: Other product: - Splunk Behavioral Analytics required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 54 security_domain: endpoint mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id tests: - name: True Positive Test attack_data: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml index 05fd9c657f..55afcb9a07 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml @@ -14,26 +14,20 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline. data_source: -- Windows Security 4688 +- Powershell 4104 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", - null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) - | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), + device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), + "string", null) | eval process=ucast(map_get(input_event,"process"), "map", null) | eval process_file=ucast(map_get(process,"file"), "map", + null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) + | eval process_uid=ucast(map_get(process,"uid"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, - /(?i)get-domainuser/)=true --finding_report--' + null) | eval actor_user=ucast(map_get(actor,"user"), "map", null) | + eval actor_user_uid=ucast(map_get(actor_user,"uid"), "string", null) | where match_regex(process_cmd_line, + /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line, /(?i)get-domainuser/)=true + --finding_report--' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -53,39 +47,37 @@ tags: - T1558 - T1558.004 observable: - - name: process.user.name - type: User Name - name: device.hostname type: Hostname + - name: process.file.path + type: File + - name: process.uid + type: Other - name: process.cmd_line type: Other + - name: actor.user.uid + type: Other product: - Splunk Behavioral Analytics required_fields: - - process.user.name - device.hostname + - process.file.path + - process.uid - process.cmd_line + - actor.user.uid risk_score: 54 security_domain: endpoint mappings: - - ocsf: process.pid - cim: process_id - - ocsf: process.file.path - cim: process_path - - ocsf: process.file.name - cim: process_name - - ocsf: process.cmd_line - cim: process - - ocsf: process.user.name - cim: user - - ocsf: actor.process.pid - cim: parent_process_id - - ocsf: actor.process.file.path - cim: parent_process_path - - ocsf: actor.process.file.name - cim: parent_process_name - ocsf: device.hostname cim: dest + - ocsf: process.file.path + cim: process_path + - ocsf: process.uid + cim: process_id + - ocsf: process.cmd_line + cim: process + - ocsf: actor.user.uid + cim: user_id tests: - name: True Positive Test attack_data: diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml index 601171e7a3..22cfaf36b6 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml @@ -20,17 +20,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information @@ -59,21 +59,36 @@ tags: mitre_attack_id: - T1020 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -85,7 +100,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml index 94adead115..bbd6c30d1f 100644 --- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml +++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml @@ -22,17 +22,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR - process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" + OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe" OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information @@ -57,21 +57,36 @@ tags: - T1197 - T1105 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 49 security_domain: endpoint mappings: @@ -83,7 +98,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml index 692edf05f2..a8765ced9b 100644 --- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true - AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line, + /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -56,21 +56,36 @@ tags: - T1218 - T1055 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -82,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml index ae056994a0..a7fb7fcc2f 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml @@ -19,16 +19,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path, /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs @@ -54,24 +54,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -83,7 +95,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml index f4f35c6b05..a25578275c 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml index dfbb6f056f..4ece03abc5 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml index 8b771d433f..e501a1e021 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)/)=true) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml index ebfff6c34e..ae25453e47 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -54,24 +54,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -83,7 +95,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml index 36fa051de5..6f8496d0b7 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program - files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, + /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml index b062070974..518186bc0a 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml @@ -19,16 +19,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml index 4b20882bd1..065beffafe 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="at.exe" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml index ffef752255..d8061c5c35 100644 --- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml +++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml @@ -19,17 +19,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, + /(?i)\\windows\\syswow64/)=true) --finding_report--' how_to_implement: To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. Collect endpoint data such as Sysmon or Windows Events 4688. @@ -53,24 +53,36 @@ tags: - T1036 - T1036.003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other - name: process.file.path type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 14 security_domain: endpoint mappings: @@ -82,7 +94,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml index 8b7af35b5b..41d78ec4ab 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml @@ -18,16 +18,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe") AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true --finding_report--' how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. You can see how we test this with [Event @@ -50,21 +50,36 @@ tags: - T1003.003 - T1003 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 40 security_domain: endpoint mappings: @@ -76,7 +91,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml index 88713600d9..2de0b7b3aa 100644 --- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml +++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml @@ -22,17 +22,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR - like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") + OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -57,21 +57,36 @@ tags: - T1218 - T1218.005 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 56 security_domain: endpoint mappings: @@ -83,7 +98,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml index 126ad471e1..b169c9e05b 100644 --- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml @@ -21,17 +21,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, - /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, + /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) + --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -55,24 +56,36 @@ tags: - T1127.001 - T1127 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -84,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 55cfdcda57..bcc100d5c2 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -21,16 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" + --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -54,21 +55,36 @@ tags: - T1218.001 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint mappings: @@ -80,7 +96,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml index 4c4f00d779..49ac3c20a6 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml @@ -26,17 +26,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="hh.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -63,21 +63,36 @@ tags: - T1218.001 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 90 security_domain: endpoint mappings: @@ -89,7 +104,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml index 3d3232ddb9..abd8a1442d 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml @@ -29,17 +29,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%")) - AND process_file_name="hh.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, + "%its:%")) AND process_file_name="hh.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -66,21 +66,36 @@ tags: - T1218.001 - T1218 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 72 security_domain: endpoint mappings: @@ -92,7 +107,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml index 5c8f9cd840..c314f2f25d 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe" - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) + AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -49,21 +49,36 @@ tags: mitre_attack_id: - T1218.007 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -75,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml index e0d3356871..a4494465de 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND - process_file_name="msiexec.exe" --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) + AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -49,21 +49,36 @@ tags: mitre_attack_id: - T1218.007 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -75,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml index e10a5de7c6..e13bc11735 100644 --- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml +++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml @@ -18,17 +18,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe" - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) + AND process_file_name="msiexec.exe" --finding_report--' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -49,21 +49,36 @@ tags: mitre_attack_id: - T1218.007 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name + - name: actor.process.file.name + type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path + - actor.process.file.name + - device.hostname risk_score: 35 security_domain: endpoint mappings: @@ -75,7 +90,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml index e55a6ce12c..7d6d33ddad 100644 --- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml +++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml @@ -22,17 +22,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval - process_user=ucast(map_get(process,"user"), "map", null) | eval process_user_name=ucast(map_get(process_user,"name"), - "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map", - null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) - | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval - actor_process_file=ucast(map_get(actor_process,"file"), "map", null) - | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string", - null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string", - null) | eval device=ucast(map_get(input_event,"device"), "map", null) - | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where - match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe" - --finding_report--' + actor=ucast(map_get(input_event,"actor"), "map", null) | eval actor_user=ucast(map_get(actor,"user"), + "map", null) | eval actor_user_name=ucast(map_get(actor_user,"name"), + "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", + null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), + "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), + "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", + null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, + /(?i)wmiprvse.exe/)=true --finding_report--' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, @@ -56,24 +56,36 @@ tags: - T1127 - T1127.001 observable: - - name: process.user.name - type: User Name - - name: device.hostname - type: Hostname + - name: process.pid + type: Other + - name: process.file.path + type: File - name: process.file.name type: File - name: process.cmd_line type: Other + - name: actor.user.name + type: User Name + - name: actor.process.pid + type: Other + - name: actor.process.file.path + type: File Name - name: actor.process.file.name type: File Name + - name: device.hostname + type: Hostname product: - Splunk Behavioral Analytics required_fields: - - process.user.name - - device.hostname + - process.pid + - process.file.path - process.file.name - process.cmd_line + - actor.user.name + - actor.process.pid + - actor.process.file.path - actor.process.file.name + - device.hostname risk_score: 80 security_domain: endpoint mappings: @@ -85,7 +97,7 @@ tags: cim: process_name - ocsf: process.cmd_line cim: process - - ocsf: process.user.name + - ocsf: actor.user.name cim: user - ocsf: actor.process.pid cim: parent_process_id