From cc7d4ca7e64eccdda10fbacdc7fb72baee8dbeb6 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 17 Aug 2023 18:31:13 -0700 Subject: [PATCH] spl fixes --- ...l_authentication_certificates___esc1_abuse.yml | 15 ++++----------- ...al_authentication_certificates___esc1_auth.yml | 4 ++-- ...uspect_process_with_authentication_traffic.yml | 6 +++--- 3 files changed, 9 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml index c49355d392..7db521e24d 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml @@ -11,7 +11,8 @@ data_source: - Windows Security 4886 - Windows Security 4887 search: >- - `wineventlog_security` EventCode IN (4886,4887) Attributes="*SAN:*upn*" Attributes="*CertificateTemplate:*"| stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| rex field=Attributes "(?i)CertificateTemplate:(?[^\r\n]+)"| rex field=Attributes "(?i)ccm:(?[^\r\n]+)"| rex max_match=10 field=Attributes "(?i)(upn=(?[^\r\n&]+))"| rex max_match=10 field=Attributes "(?i)(dns=(?[^\r\n&]+))"| rex field=Requester "(.+\\\\)?(?[^\r\n]+)"| eval flavor_text = case(EventCode=="4886","A suspicious certificate was requested using request ID: \\'RequestId\\',EventCode=="4887","A suspicious certificate was issued using request ID: \\'RequestId\\'.". To revoke this certifacte use this request ID or the SSL fingerprint [".\\'ssl_hash\\'."])",risk_score = case(EventCode=="4886",30,EventCode=="4887",60), user = upper(coalesce(req_user_1,req_user_2)), dest = upper(coalesce(req_dest_1,req_dest_2)), src = upper(coalesce(req_src,Computer))| fields - req_* | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name | `windows_steal_authentication_certificates_esc1_abuse_filter` + ``wineventlog_security` EventCode IN (4886,4887) Attributes="*SAN:*upn*" Attributes="*CertificateTemplate:*" | stats count min(_time) as firstTime max(_time) as lastTime values(name) as name values(status) as status values(Subject) as ssl_subject values(SubjectKeyIdentifier) as ssl_hash by Computer, EventCode, Requester, Attributes, RequestId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=Attributes "(?i)CertificateTemplate:(?[^\r\n]+)" | rex field=Attributes "(?i)ccm:(?[^\r\n]+)" | rex max_match=10 field=Attributes "(?i)(upn=(?[^\r\n&]+))" | rex max_match=10 field=Attributes "(?i)(dns=(?[^\r\n&]+))" | rex field=Requester "(.+\\\\)?(?[^\r\n]+)" | eval flavor_text = case(EventCode=="4886","A suspicious certificate was requested using request ID: 'RequestId'. To revoke this certificate, use this request ID or the SSL fingerprint ['ssl_hash'].",EventCode=="4887", + "A suspicious certificate was issued using request ID: 'RequestId'. To revoke this certificate, use this request ID or the SSL fingerprint ['ssl_hash']."),risk_score = case(EventCode=="4886", 30,EventCode=="4887", 60),user = upper(coalesce(req_user_1, req_user_2)),dest = upper(coalesce(req_dest_1, req_dest_2)),src = upper(coalesce(req_src, Computer))| fields - req_* | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name, Computer as dest| table firstTime lastTime src_user user dest src signature_id signature ssl_serial ssl_subject_common_name flavor_text | `windows_steal_authentication_certificates___esc1_abuse_filter` how_to_implement: >- To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum. known_false_positives: >- @@ -34,20 +35,12 @@ tags: type: Hostname role: - Victim - - name: src_user - type: User Name - role: - - Victim - name: user type: User Name role: - Victim - - name: ssl_hash - type: Other - role: - - Attacker - - name: ssl_serial - type: Other + - name: src_user + type: User Name role: - Attacker product: diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml index a91a4ee057..c0217beff9 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_auth.yml @@ -19,7 +19,7 @@ search: >- | rex max_match=10 field=Attributes "(?i)(dns=(?[^\r\n&]+))" | rex field=Requester "(.+\\\\)?(?[^\r\n]+)" | rename Attributes as object_attrs, EventCode as signature_id, name as signature, RequestId as ssl_serial, Requester as ssl_subject_common_name - | eval user = upper(coalesce(req_user_1,req_user_2)) + | eval user = lower(coalesce(req_user_1,req_user_2)) | join user [ | search `wineventlog_security` EventCode=4768 CertThumbprint=* @@ -31,7 +31,7 @@ search: >- | fields - req_* auth_* | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_steal_authentication_certificates_esc1_auth_filter` + | `windows_steal_authentication_certificates___esc1_authentication_filter` how_to_implement: >- To implement this analytic, enhanced Audit Logging must be enabled on AD CS and within Group Policy Management for CS server. See Page 115 of first reference. Recommend throttle correlation by RequestId/ssl_serial at minimum. known_false_positives: >- diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index adae4f5235..8fb98fd699 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -22,7 +22,7 @@ search: >- | rename app as process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_suspect_process_with_auth_traffic_filter` + | `windows_suspect_process_with_authentication_traffic_filter` how_to_implement: >- To implement this analytic, Sysmon should be installed in the environment and generating network events for userland and/or known public writable locations. @@ -81,6 +81,6 @@ tests: - name: True Positive Test attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_sysmon.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog update_timestamp: true \ No newline at end of file