From 767f562d58b01e4c6a19b6c1e02bb534692af02b Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 17 May 2021 10:50:49 +0200 Subject: [PATCH 01/18] rns_notes --- detections/endpoint/ransomware_notes_bulk_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index ace3740572..89173358c8 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. + industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer From 99681d7f469f9e54eedbb96a2bd3be8769da79d9 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 19 May 2021 16:06:45 +0200 Subject: [PATCH 02/18] lndn1 --- ...allow_inbound_traffic_in_firewall_rule.yml | 38 +++++++++++++++++ .../enable_rdp_in_other_port_number.yml | 42 +++++++++++++++++++ .../endpoint/mailsniper_invoke_functions.yml | 41 ++++++++++++++++++ ..._inbound_traffic_in_firewall_rule.test.yml | 12 ++++++ .../enable_rdp_in_other_port_number.test.yml | 12 ++++++ .../mailsniper_invoke_functions.test.yml | 12 ++++++ 6 files changed, 157 insertions(+) create mode 100644 detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml create mode 100644 detections/endpoint/enable_rdp_in_other_port_number.yml create mode 100644 detections/endpoint/mailsniper_invoke_functions.yml create mode 100644 tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml create mode 100644 tests/endpoint/enable_rdp_in_other_port_number.test.yml create mode 100644 tests/endpoint/mailsniper_invoke_functions.test.yml diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml new file mode 100644 index 0000000000..63e36070eb --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -0,0 +1,38 @@ +name: Allow Inbound Traffic In Firewall Rule +id: a5d85486-b89c-11eb-8267-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. + This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `allow_inbound_traffic_in_firewall_rule_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: administrator may allow inbound traffic in certain network or machine. +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml new file mode 100644 index 0000000000..aa0ab42279 --- /dev/null +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -0,0 +1,42 @@ +name: Enable RDP In Other Port Number +id: 99495452-b899-11eb-96dc-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a modification to registry to enable rdp to a machine with different port number. + This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" + Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name + | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` + | `drop_dm_object_name(Registry)` + | `enable_rdp_in_other_port_number_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +tags: + analytic_story: + - UPDATE_STORY_NAME + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.dest + - Registry.user + - Registry.registry_value_name + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml new file mode 100644 index 0000000000..2801a7ad11 --- /dev/null +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -0,0 +1,41 @@ +name: Mailsniper Invoke functions +id: a36972c8-b894-11eb-9f78-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect known mailsniper.ps1 functions executed in a machine. + This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. +search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", + "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", + "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", + "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: unknown +references: +- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ +tags: + analytic_story: + - UPDATE_STORY_NAME + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1114.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml new file mode 100644 index 0000000000..81bb7b3b73 --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic In Firewall Rule Unit Test +tests: +- name: Allow Inbound Traffic In Firewall Rule + file: detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/enable_rdp_in_other_port_number.test.yml b/tests/endpoint/enable_rdp_in_other_port_number.test.yml new file mode 100644 index 0000000000..923a16984b --- /dev/null +++ b/tests/endpoint/enable_rdp_in_other_port_number.test.yml @@ -0,0 +1,12 @@ +name: Enable RDP In Other Port Number Unit Test +tests: +- name: Enable RDP In Other Port Number + file: detections/endpoint/enable_rdp_in_other_port_number.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml new file mode 100644 index 0000000000..8a7218a8df --- /dev/null +++ b/tests/endpoint/mailsniper_invoke_functions.test.yml @@ -0,0 +1,12 @@ +name: Mailsniper Invoke functions Unit Test +tests: +- name: Mailsniper Invoke functions + file: detections/endpoint/mailsniper_invoke_functions.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 80210ef7d8af942862898487214040ef229f42db Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 26 May 2021 13:33:47 +0200 Subject: [PATCH 03/18] casper1 --- ...ound_traffic_by_firewall_rule_registry.yml | 45 ++++++++++++++++++ ...allow_inbound_traffic_in_firewall_rule.yml | 3 +- .../enable_rdp_in_other_port_number.yml | 3 +- .../endpoint/mailsniper_invoke_functions.yml | 2 +- .../secretdumps_offline_ntds_dumping_tool.yml | 46 +++++++++++++++++++ ...traffic_by_firewall_rule_registry.test.yml | 12 +++++ ..._inbound_traffic_in_firewall_rule.test.yml | 10 ++-- .../enable_rdp_in_other_port_number.test.yml | 8 ++-- .../mailsniper_invoke_functions.test.yml | 10 ++-- ...etdumps_offline_ntds_dumping_tool.test.yml | 12 +++++ 10 files changed, 134 insertions(+), 17 deletions(-) create mode 100644 detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml create mode 100644 detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml create mode 100644 tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml create mode 100644 tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml new file mode 100644 index 0000000000..cb1e0b56d0 --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -0,0 +1,45 @@ +name: Allow Inbound Traffic By Firewall Rule Registry +id: 0a46537c-be02-11eb-92ca-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. + This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" + Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" + Registry.registry_value_name = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user + Registry.registry_value_name Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` + | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. +references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.dest + - Registry.user + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 63e36070eb..3a0aabc158 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -18,9 +18,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin registry to monitor this event. known_false_positives: administrator may allow inbound traffic in certain network or machine. references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps tags: analytic_story: - - UPDATE_STORY_NAME + - Prohibited Traffic Allowed or Protocol Mismatch kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index aa0ab42279..e38a959e7e 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -22,9 +22,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: unknown references: +- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ tags: analytic_story: - - UPDATE_STORY_NAME + - Prohibited Traffic Allowed or Protocol Mismatch kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 2801a7ad11..709011989b 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -23,7 +23,7 @@ references: - https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ tags: analytic_story: - - UPDATE_STORY_NAME + - Data Exfiltration kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml new file mode 100644 index 0000000000..faf8d9e151 --- /dev/null +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -0,0 +1,46 @@ +name: SecretDumps Offline NTDS Dumping Tool +id: 5672819c-be09-11eb-bbfb-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. + This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" + (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process = "*-bootkey*") + by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `secretdumps_offline_ntds_dumping_tool_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py +tags: + analytic_story: + - Credential Dumping + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml new file mode 100644 index 0000000000..39d282bf2b --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic By Firewall Rule Registry Unit Test +tests: +- name: Allow Inbound Traffic By Firewall Rule Registry + file: endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml index 81bb7b3b73..ac2dd09fa0 100644 --- a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml +++ b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml @@ -1,12 +1,12 @@ name: Allow Inbound Traffic In Firewall Rule Unit Test tests: - name: Allow Inbound Traffic In Firewall Rule - file: detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml + file: endpoint/allow_inbound_traffic_in_firewall_rule.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/enable_rdp_in_other_port_number.test.yml b/tests/endpoint/enable_rdp_in_other_port_number.test.yml index 923a16984b..0dc6954b03 100644 --- a/tests/endpoint/enable_rdp_in_other_port_number.test.yml +++ b/tests/endpoint/enable_rdp_in_other_port_number.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml index 8a7218a8df..067c1bc19f 100644 --- a/tests/endpoint/mailsniper_invoke_functions.test.yml +++ b/tests/endpoint/mailsniper_invoke_functions.test.yml @@ -1,12 +1,12 @@ name: Mailsniper Invoke functions Unit Test tests: - name: Mailsniper Invoke functions - file: detections/endpoint/mailsniper_invoke_functions.yml + file: endpoint/mailsniper_invoke_functions.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml new file mode 100644 index 0000000000..061bd35c35 --- /dev/null +++ b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml @@ -0,0 +1,12 @@ +name: SecretDumps Offline NTDS Dumping Tool Unit Test +tests: +- name: SecretDumps Offline NTDS Dumping Tool + file: endpoint/secretdumps_offline_ntds_dumping_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 91978e5c10fec1390bfa90cb727fe748cc3a5545 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 26 May 2021 13:37:03 +0200 Subject: [PATCH 04/18] Update enable_rdp_in_other_port_number.test.yml --- tests/endpoint/enable_rdp_in_other_port_number.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/enable_rdp_in_other_port_number.test.yml b/tests/endpoint/enable_rdp_in_other_port_number.test.yml index 0dc6954b03..25e3995cc1 100644 --- a/tests/endpoint/enable_rdp_in_other_port_number.test.yml +++ b/tests/endpoint/enable_rdp_in_other_port_number.test.yml @@ -1,7 +1,7 @@ name: Enable RDP In Other Port Number Unit Test tests: - name: Enable RDP In Other Port Number - file: detections/endpoint/enable_rdp_in_other_port_number.yml + file: endpoint/enable_rdp_in_other_port_number.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 731649641b5de66569efaed8c6e0fc5b8d8cf829 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 26 May 2021 15:20:32 +0200 Subject: [PATCH 05/18] bug fix in detection testing --- automated_detection_testing/detection_service.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py index bb025e0042..551082241b 100644 --- a/automated_detection_testing/detection_service.py +++ b/automated_detection_testing/detection_service.py @@ -105,13 +105,6 @@ def main(args): with open('attack_range/attack_range.conf', 'w') as file: file.write(filedata) - # check if terraform is installed - if which('terraform') is None: - sys.exit(1) - else: - # init terraform - os.system('cd attack_range/terraform/aws && terraform init && cd ../../..') - module = __import__('attack_range') module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name] From e824025040fb01bb4316bb4f4e38cb10924479ea Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 14:15:44 +0000 Subject: [PATCH 06/18] Added detection testing service results inAllow Inbound Traffic By Firewall Rule Registry --- ...ound_traffic_by_firewall_rule_registry.yml | 28 +++++++++++-------- 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index cb1e0b56d0..c991e648d7 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -6,22 +6,23 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. - This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. +description: This analytic detects a potential suspicious modification of firewall + rule registry allowing inbound traffic in specific port with public profile. This + technique was seen in some attacker want to have a remote access to a machine by + allowing the traffic in firewall rule. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" - Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" - Registry.registry_value_name = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user - Registry.registry_value_name Registry.dest - | `drop_dm_object_name(Registry)` - | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `allow_inbound_traffic_by_firewall_rule_registry_filter`' + Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = + "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name + = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered. +known_false_positives: network admin may add/remove/modify public inbound firewall + rule that may cause this rule to be triggered. references: - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps tags: @@ -41,5 +42,8 @@ tags: - Registry.registry_value_name - Registry.registry_key_name - Registry.dest - - Registry.user - security_domain: endpoint \ No newline at end of file + - Registry.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log From affae55ecf1776c012eb251de080ff7abcd0fdf1 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 15:07:28 +0000 Subject: [PATCH 07/18] Added detection testing service results inEnable RDP In Other Port Number --- .../enable_rdp_in_other_port_number.yml | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index e38a959e7e..eaf7807ce6 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a modification to registry to enable rdp to a machine with different port number. - This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain control of it. +description: This search is to detect a modification to registry to enable rdp to + a machine with different port number. This technique was seen in some atttacker + tries to do lateral movement and remote access to a compromised machine to gain + control of it. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp*" - Registry.registry_key_name = "PortNumber" by Registry.dest Registry.user Registry.registry_value_name - | `security_content_ctime(lastTime)` - | `security_content_ctime(firstTime)` - | `drop_dm_object_name(Registry)` - | `enable_rdp_in_other_port_number_filter`' + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal + Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -40,4 +40,7 @@ tags: - Registry.dest - Registry.user - Registry.registry_value_name - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log From 819c8f4db82e9a1141ba50cdb92743eb31adca71 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 15:51:03 +0000 Subject: [PATCH 08/18] Added detection testing service results inSecretDumps Offline NTDS Dumping Tool --- .../secretdumps_offline_ntds_dumping_tool.yml | 27 +++++++++++-------- 1 file changed, 16 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index faf8d9e151..1a91a7be88 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -6,15 +6,17 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. - This technique was seen in some attacker that dump ntlm hashes offline after having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "python*.exe" Processes.process = "*.py*" Processes.process = "*-ntds*" - (Processes.process = "*-system*" OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process = "*-bootkey*") - by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This analytic detects a potential usage of secretsdump.py tool for dumping + credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry + hive. This technique was seen in some attacker that dump ntlm hashes offline after + having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" + Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" + OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process + = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `secretdumps_offline_ntds_dumping_tool_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -42,5 +44,8 @@ tags: - Processes.parent_process - Processes.dest Processes.user - Processes.process_id - - Processes.process_guid - security_domain: endpoint \ No newline at end of file + - Processes.process_guid + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log From 27007cc19d34f0654fdeac64575c0548c79800f0 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 16:17:03 +0000 Subject: [PATCH 09/18] Added detection testing service results inAllow Inbound Traffic In Firewall Rule --- ...allow_inbound_traffic_in_firewall_rule.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 3a0aabc158..8193070f70 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -6,17 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious powershell command to allow inbound traffic in specific local port with public profile. - This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. -search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" -| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `allow_inbound_traffic_in_firewall_rule_filter`' +description: This search is to detect suspicious powershell command to allow inbound + traffic in specific local port with public profile. This technique was seen in some + attacker want to have a remote access to a machine by allowing the traffic in firewall + rule. +search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message + = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. -known_false_positives: administrator may allow inbound traffic in certain network or machine. +known_false_positives: administrator may allow inbound traffic in certain network + or machine. references: - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps tags: @@ -36,4 +38,7 @@ tags: - Message - ComputerName - User - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log From 259842d958d172fa809dd9e4a61f6ba70922dd81 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 26 May 2021 16:41:52 +0000 Subject: [PATCH 10/18] Added detection testing service results inMailsniper Invoke functions --- .../endpoint/mailsniper_invoke_functions.yml | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 709011989b..b91f27648b 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -6,15 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect known mailsniper.ps1 functions executed in a machine. - This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. -search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", - "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", - "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", - "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`' +description: This search is to detect known mailsniper.ps1 functions executed in a + machine. This technique was seen in some attacker to harvest some sensitive e-mail + in a compromised exchange server. +search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", + "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", + "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", + "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mailsniper_invoke_functions_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. @@ -34,8 +35,11 @@ tags: - Splunk Cloud required_fields: - _time - - EventCode - - Message - - ComputerName + - EventCode + - Message + - ComputerName - User - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log From 9df93090873d56aa4256a5bfd73e81bda3b829b4 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 28 May 2021 09:17:34 +0200 Subject: [PATCH 11/18] nslookup --- .../excessive_usage_of_nslookup_app.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index daafa2b2bf..ac95fc2963 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -2,7 +2,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 version: 1 date: '2021-04-21' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Stanislav Miskovic, Splunk type: batch datamodel: - Endpoint @@ -12,12 +12,15 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name - | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" +| bucket _time span=15m | stats count as numNsLookup by Computer, _time +| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer +| eval upperThreshold=(avgNsLookup + stdNsLookup *3) +| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) +| search isOutlier=1 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From cac94b27e72c6b2840c12b81579c816550cfaf4e Mon Sep 17 00:00:00 2001 From: root Date: Fri, 28 May 2021 07:50:13 +0000 Subject: [PATCH 12/18] Added detection testing service results inExcessive Usage of NSLOOKUP App --- .../endpoint/excessive_usage_of_nslookup_app.yml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index ac95fc2963..8edf6f4e6e 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -12,15 +12,12 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" -| bucket _time span=15m | stats count as numNsLookup by Computer, _time -| eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer -| eval upperThreshold=(avgNsLookup + stdNsLookup *3) -| eval isOutlier=if(avgNsLookup > 20 and avgNsLookup >= upperThreshold, 1, 0) -| search isOutlier=1 -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m + | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as + avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval + upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > + 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From d0bf659d82e8419386b3c493662c99409be752a9 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 1 Jun 2021 14:48:43 -0700 Subject: [PATCH 13/18] skew for all apps --- bin/jinja2_templates/savedsearches.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index d80c836797..ba0df448e9 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -84,11 +84,11 @@ action.email.useNSSubject = 1 alert.digest_mode = 1 {% if detection.disabled is defined %} disabled = false -allow_skew = 100% {% else %} disabled = true {% endif %} enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 From 6232efe76de2107a3ecd30900522b348d5175f07 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Jun 2021 01:54:58 +0000 Subject: [PATCH 14/18] Bump urllib3 from 1.26.4 to 1.26.5 Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.4 to 1.26.5. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.4...1.26.5) --- updated-dependencies: - dependency-name: urllib3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 66340c90e9..15b2561964 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -70,7 +70,7 @@ splunk-sdk==1.6.15 tabulate==0.8.9 termcolor==1.1.0 toml==0.10.2 -urllib3==1.26.4 +urllib3==1.26.5 virtualenv==20.4.6 wcwidth==0.2.5 wget==3.2 diff --git a/requirements.txt b/requirements.txt index bde9d72885..cb37874b26 100644 --- a/requirements.txt +++ b/requirements.txt @@ -65,7 +65,7 @@ termcolor==1.1.0 toml==0.10.2 typing==3.7.4.3 tzlocal==2.1 -urllib3==1.26.4 +urllib3==1.26.5 virtualenv==20.4.6 wcwidth==0.2.5 webencodings==0.5.1 From 20dd0543c11a5a1a4db08545643e7b54d97a99a7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Jun 2021 03:14:05 +0000 Subject: [PATCH 15/18] Bump urllib3 from 1.26.4 to 1.26.5 in /automated_detection_testing Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.4 to 1.26.5. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.4...1.26.5) --- updated-dependencies: - dependency-name: urllib3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- automated_detection_testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 66340c90e9..15b2561964 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -70,7 +70,7 @@ splunk-sdk==1.6.15 tabulate==0.8.9 termcolor==1.1.0 toml==0.10.2 -urllib3==1.26.4 +urllib3==1.26.5 virtualenv==20.4.6 wcwidth==0.2.5 wget==3.2 From e9e82d0b16b1702cf339ac69de5fd7ba6181f6e9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Jun 2021 04:14:03 +0000 Subject: [PATCH 16/18] Bump urllib3 from 1.26.4 to 1.26.5 in /bin/ssa-end-to-end-testing Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.4 to 1.26.5. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/1.26.4...1.26.5) --- updated-dependencies: - dependency-name: urllib3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- bin/ssa-end-to-end-testing/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/ssa-end-to-end-testing/requirements.txt b/bin/ssa-end-to-end-testing/requirements.txt index df929bb9d2..6d5ea588d1 100644 --- a/bin/ssa-end-to-end-testing/requirements.txt +++ b/bin/ssa-end-to-end-testing/requirements.txt @@ -20,4 +20,4 @@ six==1.15.0 smmap==3.0.5 toml==0.10.2 u-msgpack-python==2.7.1 -urllib3==1.26.4 +urllib3==1.26.5 From 838bbc4a5872605a5a1066a09270a428f2f272c1 Mon Sep 17 00:00:00 2001 From: Vatsal Jagani Date: Wed, 2 Jun 2021 16:26:02 +0530 Subject: [PATCH 17/18] JSWorm ransomware notes and extensions added. --- lookups/ransomware_extensions.csv | 10 +++++++++- lookups/ransomware_extensions_lookup.yml | 1 + lookups/ransomware_notes.csv | 10 +++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index 9e8fe7eff6..c50ec5dc9b 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -287,4 +287,12 @@ Extensions,Name .WNCRYT,WannaCry .RYK,Ryuk .Clop,Clop -.Cllp,Clop \ No newline at end of file +.Cllp,Clop +.JSWORM,JSWorm +.NEMTY_*,Nemty +.NEFILIM,Nefilim +.OFFWHITE,Offwhite +.TELEGRAM,Telegram +.FUSION,Fusion +.MILIHPEN,Milihpen +.GANGBANG,Gangbang \ No newline at end of file diff --git a/lookups/ransomware_extensions_lookup.yml b/lookups/ransomware_extensions_lookup.yml index eed0adad33..58bc6fde38 100644 --- a/lookups/ransomware_extensions_lookup.yml +++ b/lookups/ransomware_extensions_lookup.yml @@ -1,6 +1,7 @@ default_match: 'false' description: A list of file extensions that are associated with ransomware filename: ransomware_extensions.csv +match_type: WILDCARD(Extensions) min_matches: 1 name: ransomware_extensions_lookup case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index ecdfd2479d..04bf840433 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -58,4 +58,12 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-READ-FOR-HELLPP.html,True RyukReadMe.html,True ClopReadMe.txt,True -README_README.txt,True \ No newline at end of file +README_README.txt,True +JSWORM-DECRYPT.html,True +NEMTY_*-DECRYPT.txt,True +NEFILIM-DECRYPT.txt,True +OFFWHITE-MANUAL.txt,True +TELEGRAM-RECOVER.txt,True +FUSION-README.txt,True +MILIHPEN-INSTRUCT.txt,True +GANGBANG-NOTE.txt,True \ No newline at end of file From 4d6a1c06eabbbd8404a343bd4ae21686f88b3da4 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 2 Jun 2021 13:53:08 -0700 Subject: [PATCH 18/18] adding cloud tags --- bin/appinspect.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/appinspect.sh b/bin/appinspect.sh index 7ac93bb9f7..ddc16870d6 100755 --- a/bin/appinspect.sh +++ b/bin/appinspect.sh @@ -40,7 +40,7 @@ APPINSPECT_TOKEN=$(curl -s --location --request GET 'https://api.splunk.com/2.0/ sleep 1 # submit a inspection job EXPECTS app on same directory #REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@"/home/circleci/DA-ESS-ContentUpdate-latest.tar.gz"' | jq -r '.request_id') -REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id') +REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'included_tags="cloud"' --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id') echo "app inspect request: $REQUEST_ID" sleep 5 STATUS=$(curl -s --location --request GET https://appinspect.splunk.com/v1/app/validate/status/$REQUEST_ID --header "Authorization: bearer $APPINSPECT_TOKEN" | jq -r '.status')