Merge pull request #1660 from splunk/AD_Discovery_TR-789_9

AD_Discovery_TR-789_9

detections/endpoint/getcurrent_user_with_powershell.yml

@@ -0,0 +1,66 @@
+name: GetCurrent User with PowerShell
+id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powerhsell.exe` with command-line
+  arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class.
+  This method returns an object that represents the current Windows user. Red Teams
+  and adversaries may leverage this method to identify the logged user on a compromised
+  endpoint for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/getcurrent_user_with_powershell_script_block.yml

@@ -0,0 +1,61 @@
+name: GetCurrent User with PowerShell Script Block
+id: 80879283-c30f-44f7-8471-d1381f6d437a
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET
+  class. This method returns an object that represents the current Windows user. Red
+  Teams and adversaries may leverage this method to identify the logged user on a
+  compromised endpoint for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*"
+  AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `getcurrent_user_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Path 
+  - Message
+  - OpCode 
+  - ComputerName 
+  - User
+  - EventCode
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/system_user_discovery_with_query.yml

@@ -0,0 +1,65 @@
+name: System User Discovery With Query
+id: ad03bfcf-8a91-4bc2-a500-112993deba87
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `query.exe` with command-line
+  arguments utilized to discover the logged user. Red Teams and adversaries alike
+  may leverage `query.exe` to identify system users on a compromised endpoint for
+  situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe")
+  (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `system_user_discovery_with_query_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/system_user_discovery_with_whoami.yml

@@ -0,0 +1,64 @@
+name: System User Discovery With Whoami
+id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `whoami.exe` without any arguments.
+  This windows native binary prints out the current logged user. Red Teams and adversaries
+  alike may leverage `whoami.exe` to identify system users on a compromised endpoint
+  for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/user_discocvery_with_env_vars_powershell.yml

@@ -0,0 +1,66 @@
+name: User Discovery With Env Vars PowerShell
+id: 0cdf318b-a0dd-47d7-b257-c621c0247de8
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments that leverage PowerShell environment variables to identify the current
+  logged user. Red Teams and adversaries may leverage this method to identify the
+  logged user on a compromised endpoint for situational awareness and Active Directory
+  Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml

@@ -0,0 +1,59 @@
+name: User Discovery With Env Vars PowerShell Script Block
+id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the use of PowerShell environment variables to identify the current
+  logged user. Red Teams and adversaries may leverage this method to identify the
+  logged user on a compromised endpoint for situational awareness and Active Directory
+  Discovery.
+search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Path 
+  - Message
+  - OpCode 
+  - ComputerName 
+  - User
+  - EventCode
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System user discovery on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

tests/endpoint/getcurrent_user_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: GetCurrent User with PowerShell Unit Test
+tests:
+- name: GetCurrent User with PowerShell
+  file: endpoint/getcurrent_user_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: GetCurrent User with PowerShell Script Block Unit Test
+tests:
+- name: GetCurrent User with PowerShell Script Block
+  file: endpoint/getcurrent_user_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/system_user_discovery_with_query.test.yml

@@ -0,0 +1,12 @@
+name: System User Discovery With Query Unit Test
+tests:
+- name: System User Discovery With Query
+  file: endpoint/system_user_discovery_with_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/system_user_discovery_with_whoami.test.yml

@@ -0,0 +1,12 @@
+name: System User Discovery With Whoami Unit Test
+tests:
+- name: System User Discovery With Whoami
+  file: endpoint/system_user_discovery_with_whoami.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/user_discocvery_with_env_vars_powershell.test.yml

@@ -0,0 +1,12 @@
+name: User Discovery With Env Vars PowerShell Unit Test
+tests:
+- name: User Discovery With Env Vars PowerShell
+  file: endpoint/user_discocvery_with_env_vars_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/user_discovery_with_env_vars_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: User Discovery With Env Vars PowerShell Script Block Unit Test
+tests:
+- name: User Discovery With Env Vars PowerShell Script Block
+  file: endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog