diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml new file mode 100644 index 0000000000..33bf966efe --- /dev/null +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -0,0 +1,102 @@ +name: ServicePrincipalNames Discovery with PowerShell +id: 13243068-2d38-11ec-8908-acde48001122 +version: 1 +date: '2021-10-14' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies `powershell.exe` usage, using Script + Block Logging EventCode 4104, related to querying the domain for Service Principle + Names. typically, this is a precursor activity related to kerberoasting or the silver + ticket attack. \ + + What is a ServicePrincipleName? \ + + A service principal name (SPN) is a unique identifier of a service instance. SPNs + are used by Kerberos authentication to associate a service instance with a service + logon account. This allows a client application to request that the service authenticate + an account even if the client does not have the account name.\ + + The following analytic identifies the use of KerberosRequestorSecurityToken class + within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken + class in PowerShell is the equivelant of using setspn.exe. \ + + During triage, review parallel processes for further suspicious activity.' +search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" | + stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName + User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `serviceprincipalnames_discovery_with_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names +- https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8 +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting +- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html +- https://attack.mitre.org/techniques/T1558/003/ +- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx +- https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ +- https://blog.zsec.uk/paving-2-da-wholeset/ +- https://msitpros.com/?p=3113 +- https://adsecurity.org/?p=3466 +- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 +- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf +- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ +tags: + analytic_story: + - Active Directory Discovery + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1558.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to identify service principle names. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml new file mode 100644 index 0000000000..fe414f47d2 --- /dev/null +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -0,0 +1,109 @@ +name: ServicePrincipalNames Discovery with SetSPN +id: ae8b3efc-2d2e-11ec-8b57-acde48001122 +version: 1 +date: '2021-10-14' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: 'The following analytic identifies `setspn.exe` usage related to querying + the domain for Service Principle Names. typically, this is a precursor activity + related to kerberoasting or the silver ticket attack. \ + + What is a ServicePrincipleName? \ + + A service principal name (SPN) is a unique identifier of a service instance. SPNs + are used by Kerberos authentication to associate a service instance with a service + logon account. This allows a client application to request that the service authenticate + an account even if the client does not have the account name.\ + + Example usage includes the following \ + + 1. setspn -T offense -Q */* 1. setspn -T attackrange.local -F -Q MSSQLSvc/* 1. setspn + -Q */* > allspns.txt 1. setspn -q \ + + Values \ + + 1. -F = perform queries at the forest, rather than domain level 1. -T = perform + query on the specified domain or forest (when -F is also used) 1. -Q = query for + existence of SPN \ + + During triage, review parallel processes for further suspicious activity.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_setspn` (Processes.process="*-t*" + AND Processes.process="*-f*") OR (Processes.process="*-q*" AND Processes.process="**/**") + OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be caused by Administrators resetting SPNs + or querying for SPNs. Filter as needed. +references: +- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting +- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html +- https://attack.mitre.org/techniques/T1558/003/ +- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx +- https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ +- https://blog.zsec.uk/paving-2-da-wholeset/ +- https://msitpros.com/?p=3113 +- https://adsecurity.org/?p=3466 +tags: + analytic_story: + - Active Directory Discovery + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1558.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to identify service principle names. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + automated_detection_testing: passed diff --git a/macros/process_setspn.yml b/macros/process_setspn.yml new file mode 100644 index 0000000000..9c840ca5a9 --- /dev/null +++ b/macros/process_setspn.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_setspn diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml new file mode 100644 index 0000000000..305b968da4 --- /dev/null +++ b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: ServicePrincipalNames Discovery with PowerShell Unit Test +tests: +- name: ServicePrincipalNames Discovery with PowerShell + file: endpoint/serviceprincipalnames_discovery_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell_kerberos.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_setspn.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_setspn.test.yml new file mode 100644 index 0000000000..d094d7ebe1 --- /dev/null +++ b/tests/endpoint/serviceprincipalnames_discovery_with_setspn.test.yml @@ -0,0 +1,12 @@ +name: ServicePrincipalNames Discovery with SetSPN Unit Test +tests: +- name: ServicePrincipalNames Discovery with SetSPN + file: endpoint/serviceprincipalnames_discovery_with_setspn.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon_setspn.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file