mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
pyth0n1c
+40
-17
@@ -40,6 +40,13 @@ def process_deprecated(file,file_path):
|
||||
file['description'] = DESCRIPTION_ANNOTATION + file['description']
|
||||
return file
|
||||
|
||||
def process_experimental(file,file_path):
|
||||
DESCRIPTION_ANNOTATION = "WARNING, this is a experimental detection, Splunk Threat Research has not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is NOT supported. If you have any questions feel free to email us at: research@splunk.com. "
|
||||
if 'experimental' in file_path:
|
||||
file['experimental'] = True
|
||||
file['experimental'] = DESCRIPTION_ANNOTATION + file['description']
|
||||
return file
|
||||
|
||||
def load_file(file_path):
|
||||
with open(file_path, 'r', encoding="utf-8") as stream:
|
||||
try:
|
||||
@@ -47,6 +54,7 @@ def load_file(file_path):
|
||||
|
||||
# mark any files that have been deprecated
|
||||
file = process_deprecated(file,file_path)
|
||||
file = process_experimental(file,file_path)
|
||||
|
||||
except yaml.YAMLError as exc:
|
||||
print(exc)
|
||||
@@ -105,29 +113,44 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
yaml.Dumper.ignore_aliases = lambda *args : True
|
||||
|
||||
# wiping old detections for SSA
|
||||
shutil.rmtree(OUTPUT_PATH + '/detections/*', ignore_errors=True)
|
||||
shutil.rmtree(OUTPUT_PATH + '/srs/', ignore_errors=True)
|
||||
shutil.rmtree(OUTPUT_PATH + '/complex/', ignore_errors=True)
|
||||
os.makedirs(OUTPUT_PATH + '/complex/')
|
||||
os.makedirs(OUTPUT_PATH + '/srs/')
|
||||
|
||||
for d in detections:
|
||||
manifest_file = OUTPUT_PATH + '/detections/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
|
||||
# skip deprecated
|
||||
if ('deprecated' in d and d['deprecated']) or ('experimental' in d and d['experimental']):
|
||||
continue
|
||||
else:
|
||||
# check if the search contains "stats", "first_time_event", or "adaptive_threshold" which would make it a complex pipeline
|
||||
pattern = re.compile('stats|first_time_event|adaptive_threshold|conditional_anomaly')
|
||||
|
||||
# remove unused fields
|
||||
del d['risk']
|
||||
del d['deployment']
|
||||
del d['mappings']
|
||||
del d['savedsearch_annotations']
|
||||
if re.findall("stats|first_time_event|adaptive_threshold", d['search']):
|
||||
# it is a complex pipeline
|
||||
manifest_file = OUTPUT_PATH + '/complex/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
|
||||
else:
|
||||
# it is a simple pipeline can be placed on SRS (Simple Rule Service)
|
||||
manifest_file = OUTPUT_PATH + '/srs/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
|
||||
|
||||
# add detection test
|
||||
test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
|
||||
for file in glob.glob('tests/*/*'):
|
||||
if test_file == file.split("/")[-1]:
|
||||
with open(file, 'r') as file:
|
||||
test_yaml = yaml.safe_load(file)
|
||||
d['test'] = test_yaml
|
||||
# remove unused fields
|
||||
del d['risk']
|
||||
del d['deployment']
|
||||
del d['mappings']
|
||||
del d['savedsearch_annotations']
|
||||
|
||||
with open(manifest_file, 'w') as file:
|
||||
documents = yaml.dump(d, file, sort_keys=True)
|
||||
# add detection test
|
||||
test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
|
||||
for file in glob.glob('tests/*/*'):
|
||||
if test_file == file.split("/")[-1]:
|
||||
with open(file, 'r') as file:
|
||||
test_yaml = yaml.safe_load(file)
|
||||
d['test'] = test_yaml
|
||||
|
||||
return OUTPUT_PATH + '/detections/'
|
||||
with open(manifest_file, 'w') as file:
|
||||
documents = yaml.dump(d, file, sort_keys=True)
|
||||
|
||||
return OUTPUT_PATH
|
||||
|
||||
def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
'''
|
||||
|
||||
-126
@@ -1,126 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket,
|
||||
Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior
|
||||
is typically performed within interactive Mimikatz memory space, however it may
|
||||
be identified on the command-line. A Pass-the-Ticket (ptt) attack is performed once
|
||||
an adversary has established access to a single endpoint and retrieved the kerberos
|
||||
ticket to now begin moving laterally using this method. Typically, it blends in
|
||||
with logon activity as the ticket can be copied to another system and passed into
|
||||
the current session effectively simulating a logon without any communication with
|
||||
the Domain Controller. A Golden or Silver ticket attack requires some setup by the
|
||||
adversary, but once performed it will simulate lateral based authentication to additional
|
||||
endpoints.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to Mimikatz.
|
||||
name: Applying Stolen Credentials via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
- https://adsecurity.org/?p=1275
|
||||
- https://adsecurity.org/?p=1515
|
||||
- https://adsecurity.org/?page_id=1821#KERBEROSPTT
|
||||
- https://attack.mitre.org/software/S0002/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
|
||||
risk_message: Mimikatz malware is violating authentication processes by injecting
|
||||
golden or silver Kerberos tickets or passing stolen authentication tokens. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
|
||||
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
|
||||
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is violating authentication processes by injecting golden
|
||||
or silver Kerberos tickets or passing stolen authentication tokens. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
- T1134
|
||||
- T1543
|
||||
- T1547
|
||||
- T1548
|
||||
- T1554
|
||||
- T1556
|
||||
- T1558
|
||||
- T1558.002
|
||||
- T1558.001
|
||||
- T1003
|
||||
- T1003.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
- cmd_line
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test applying stolen credentials detections
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
|
||||
name: Applying Stolen Credentials via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
-121
@@ -1,121 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies commonly used PowerSploit modules that perform credential access,
|
||||
spoofing of authentication processes, user impersonation and attempting to manipulate
|
||||
tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`,
|
||||
`Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied
|
||||
as modules used to access credentials. PowerSploit is an archived project on GitHub,
|
||||
but much of its modules and scripts are still utilized today by adversaries. This
|
||||
behavior is typically performed within interactive PowerShell sessions or injected
|
||||
into processes, however it may be identified on the command-line.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 270b482d-2af2-448f-9923-9cf005f61be4
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to PowerSploit.
|
||||
name: Applying Stolen Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
- https://attack.mitre.org/software/S0194/
|
||||
risk_message: PowerSploit malware is violating authentication by injecting stolen
|
||||
credentials, manipulating authentication tokens or impersonating system or user
|
||||
accounts. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is violating authentication by injecting stolen credentials,
|
||||
manipulating authentication tokens or impersonating system or user accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
- T1134
|
||||
- T1543
|
||||
- T1547
|
||||
- T1548
|
||||
- T1554
|
||||
- T1555
|
||||
- T1558
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
- cmd_line
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test applying stolen credentials detections
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
|
||||
name: Applying Stolen Credentials via PowerSploit
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
-93
@@ -1,93 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that
|
||||
verifies password strength. Adversaries have utilized this module to determine password
|
||||
complexity or to identify accounts with weak passwords.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Assessment of Credential Strength via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
|
||||
Account attempting this operation is $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Test-PasswordQuality/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 85
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
|
||||
Account attempting this operation is $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
- T1087
|
||||
- T1201
|
||||
- T1552
|
||||
- T1555
|
||||
- T1059.001
|
||||
- T1059
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_score: 25
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
Vendored
-100
@@ -1,100 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies the use of CacheDump with the `-s` parameter to dump cached
|
||||
credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available
|
||||
tool that extracts cached password hashes from a system''s registry.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 312582f2-5e91-42c1-a275-cd67f31373c8
|
||||
known_false_positives: False positives will be limited as this analytic targets specific
|
||||
credential dumping process names. Filter as needed.
|
||||
name: Credential Extraction indicative of FGDump and CacheDump with s option
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://attack.mitre.org/software/S0119/
|
||||
- https://en.kali.tools/all/?tool=182
|
||||
- http://foofus.net/goons/fizzgig/fgdump/
|
||||
- https://attack.mitre.org/software/S0120/
|
||||
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
|
||||
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$.
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND process_name != null AND parent_process_name != null
|
||||
AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name,
|
||||
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
|
||||
AND match_regex(cmd_line, /(?i)\-s/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
|
||||
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$.
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
Vendored
-93
@@ -1,93 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies the use of CacheDump with the `-v` parameter to dump cached
|
||||
credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available
|
||||
tool that extracts cached password hashes from a system''s registry.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
|
||||
known_false_positives: False positives will be limited as this analytic targets specific
|
||||
credential dumping process names. Filter as needed.
|
||||
name: Credential Extraction indicative of FGDump and CacheDump with v option
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
|
||||
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
|
||||
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
|
||||
AND match_regex(cmd_line, /(?i)\-v/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
|
||||
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-18'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. LaZagne is a tool that extracts various kinds
|
||||
of credentials from a local computer, including account passwords, domain passwords,
|
||||
browser passwords, etc.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 341975fa-4ad0-4f01-9acc-df4f69742db7
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction indicative of Lazagne command line options
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
|
||||
/(?i)all\s+\-oA\s+\-output/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Lazagne malware is extracting/decoding encoded credentials. Operation is
|
||||
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1555
|
||||
nist:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-104
@@ -1,104 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies modules within DSInternals that are used for extracting credentials
|
||||
from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`,
|
||||
`ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`,
|
||||
`ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
|
||||
Adversaries may use these modules for decrypting or transforming the stored credentials.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Credential Extraction indicative of use of DSInternals credential conversion
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is converting stolen credential material to a form
|
||||
applicable to authentications. Operation is performed on the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via process $process_name$.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertTo-UnicodePassword/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is converting stolen credential material to a form
|
||||
applicable to authentications. Operation is performed on the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via process $process_name$.
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
Vendored
-106
@@ -1,106 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies modules of DSInternals being used on the associated endpoint.
|
||||
Adversaries may use these modules for manipulating data related to Active Directory
|
||||
and credentials.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Credential Extraction indicative of use of DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is accessing sensitive credential material such
|
||||
as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-SamPasswordPolicy/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is accessing sensitive credential material such as
|
||||
KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-21'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. Mimikatz is a collection of tools and modules
|
||||
commonly employed in Windows exploits.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction indicative of use of Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores
|
||||
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true
|
||||
OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Unusual Processes
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 95
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is extracting/decoding encoded credentials from stores
|
||||
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 66
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-91
@@ -1,91 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-21'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. PowerSploit is a collection of Microsoft PowerShell
|
||||
modules commonly employed in exploits.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction indicative of use of PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
||||
logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
|
||||
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
||||
logings. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-95
@@ -1,95 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-18'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. Native Microsoft debuggers, such as kd, ntkd,
|
||||
livekd and windbg, can be leveraged to read credential material directly from memory
|
||||
and process dumps.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112
|
||||
known_false_positives: Although unlikely, using debuggers this way may be indicative
|
||||
of developers analyzing crash dumps of their code. Note, even for developers this
|
||||
is an unusual way of working on code - debuggers are mostly used to step through
|
||||
code, not analyze its crash dumps.
|
||||
name: Credential Extraction native Microsoft debuggers peek into the kernel
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
|
||||
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
|
||||
native debugging tools. Operation is performed at the device $dest_device_id$, by
|
||||
the account $dest_user_id$ via command $cmd_line$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | where cmd_line != null AND parent_process_name != null AND process_name
|
||||
!= null AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name,
|
||||
/(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true
|
||||
AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Unusual Processes
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
|
||||
native debugging tools. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-91
@@ -1,91 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-18'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. Native Microsoft debuggers, such as kd, ntkd,
|
||||
livekd and windbg, can be leveraged to read credential material directly from memory
|
||||
and process dumps.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: adc51a77-90c9-4358-b43c-f10dd1a27d05
|
||||
known_false_positives: Although unlikely, using debuggers this way may be indicative
|
||||
of developers analyzing crash dumps of their code. Note, even for developers this
|
||||
is an unusual way of working on code - debuggers are mostly used to step through
|
||||
code, not analyze its crash dumps.
|
||||
name: Credential Extraction native Microsoft debuggers via z command line option
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
|
||||
native debugging tools. Operation is performed at the device $dest_device_id$, by
|
||||
the account $dest_user_id$ via command $cmd_line$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name,
|
||||
/^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line,
|
||||
/(?i)\-z\s+/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Unusual Processes
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
|
||||
native debugging tools. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-86
@@ -1,86 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-18'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. PowerSploit and DSInternals are common exploit
|
||||
APIs offering PowerShell modules for various exploits of Windows and Active Directory
|
||||
environments.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
|
||||
DSInternals
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
|
||||
module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
|
||||
/(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
|
||||
module. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,94 +0,0 @@
|
||||
author: Xiao Lin, Splunk
|
||||
datamodel:
|
||||
- Certificates
|
||||
date: '2020-10-21'
|
||||
description: This search detects a potential kerberoasting attack via service principal
|
||||
name requests
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
|
||||
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
|
||||
generate false positives
|
||||
name: Detect Kerberoasting
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
|
||||
risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
|
||||
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
|
||||
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
|
||||
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
|
||||
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
|
||||
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
|
||||
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
|
||||
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
|
||||
| eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id,
|
||||
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
|
||||
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 16
|
||||
confidence: 20
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Kerberoasting malware is potentially applying stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1558.003
|
||||
- T1558
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- service_name
|
||||
- _time
|
||||
- event_code
|
||||
- ticket_encryption_type
|
||||
- service_id
|
||||
- ticket_options
|
||||
risk_score: 14
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Detect Kerberoasting - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test detection of kerberoasting
|
||||
file: endpoint/ssa___detect_kerberoasting.yml
|
||||
name: Detect kerberoasting
|
||||
pass_condition: '@count_eq(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,92 +0,0 @@
|
||||
author: Xiao Lin, Splunk
|
||||
datamodel:
|
||||
- Authentication
|
||||
date: '2020-10-21'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This search
|
||||
looks for specific authentication events from the Windows Security Event logs to
|
||||
detect potential attempts using Pass-the-Hash technique.'
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
|
||||
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
|
||||
detected by this search. Please investigate as appropriate.
|
||||
name: Detect Pass the Hash
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
|
||||
risk_message: Potential use of the pass the hash/token attacks that spoof authentication.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
|
||||
| eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
|
||||
"authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
|
||||
origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
|
||||
| where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
|
||||
AND authentication_method="seclogo")
|
||||
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
|
||||
dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
|
||||
"authentication_method", authentication_method]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Lateral Movement
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 20
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Potential use of the pass the hash/token attacks that spoof authentication.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1550
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- signature_id
|
||||
- authentication_type
|
||||
- _time
|
||||
- authentication_method
|
||||
- origin_device_domain
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
risk_score: 16
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,89 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: This search looks for command-line arguments that use a `/c` parameter
|
||||
to execute a command that has not previously been seen. This is an implementation
|
||||
on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following
|
||||
analytic identifies first time seen command-line arguments on a single endpoint.
|
||||
The analytic looks for arguments instantiated by `cmd.exe /c` and the associated
|
||||
command-line. Adversaries automate or spawn multiple processes using this method,
|
||||
this analytic may assist with identifying the first time it's been found on this
|
||||
endpoint.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
|
||||
known_false_positives: Legitimate programs use command-line arguments to execute.
|
||||
Verify the command-line arguments to check what command/program is being executed.
|
||||
Filtering will be needed.
|
||||
name: First time seen command line argument
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: A process $process_name$ ha been identified in the environment with
|
||||
a command-line $cmd_line$ not previously seen before on host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
|
||||
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
|
||||
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
|
||||
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
|
||||
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
|
||||
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
|
||||
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
|
||||
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
|
||||
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
|
||||
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
|
||||
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 8
|
||||
confidence: 60
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Command and Control
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ ha been identified in the environment with a command-line
|
||||
$cmd_line$ not previously seen before on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1202
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 30
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: Anomaly
|
||||
version: 4
|
||||
-92
@@ -1,92 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegaly access user content,
|
||||
such as key logging, audio recording, screenshots, tapping into http and RDP sessions,
|
||||
etc.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 01fc7d91-eb0c-478e-8633-e4fa4904463a
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Access To User Content via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is tapping into user content - microphone, camera,
|
||||
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-WebConfig/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Exfiltration
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 85
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is tapping into user content - microphone, camera,
|
||||
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1113
|
||||
- T1123
|
||||
- T1563
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 85
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-93
@@ -1,93 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that create accounts illegaly.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 20fba62a-fa5b-46cc-b39f-473fa248fee2
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Account Creation via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is creating illegal domain accounts. Operation is
|
||||
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)New-DomainUser/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Persistence
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is creating illegal domain accounts. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1585
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Account Creation via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal account creation detections
|
||||
file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
|
||||
name: Illegal Account Creation via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,83 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that delete event logs.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Deletion of Logs via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious
|
||||
activity. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is deleting event logs to cover tracks of malicious activity.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1070
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of DSInternals modules that enable or disable accounts illegaly.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 3e0f9962-9989-445f-878c-939443326b63
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Enabling or Disabling of Accounts via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is illegally enabling or disabling accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-89
@@ -1,89 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of DSInternals modules for illegal management of Active Directoty
|
||||
elements and policies.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: a587ca9f-c138-47b4-ba51-699f319b8cc5
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Management of Active Directory Elements and Policies via DSInternals
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is controlling infrastructure by modifying Active
|
||||
Directory elements, domain controllers, and policies. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-LsaPolicyInformation/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is controlling infrastructure by modifying Active Directory
|
||||
elements, domain controllers, and policies. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1207
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegal management of computers
|
||||
and Active Directory elements.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 75760c11-7d48-4968-b828-013b299e8f6d
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Management of Computers and Active Directory Elements via PowerSploit
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is controlling infrastructure by modifying Active
|
||||
Directory elements or local Master Boot Records. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR
|
||||
match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-MasterBootRecord/)=true )
|
||||
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is controlling infrastructure by modifying Active Directory
|
||||
elements or local Master Boot Records. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1207
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-104
@@ -1,104 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that illegaly elevate general privileges
|
||||
or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent
|
||||
WMI, access to OS objects under desired identities.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 88c10ee9-fe72-4bce-b343-5b129044b991
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is planting attack persistence elements, altering
|
||||
privileges and access controls. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true
|
||||
OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Command And Control
|
||||
- Stage:Persistence
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is planting attack persistence elements, altering privileges
|
||||
and access controls. Operation is performed at the device $dest_device_id$, by
|
||||
the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
- T1134
|
||||
- T1548
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA
|
||||
Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test privilege elevation and persistence detections
|
||||
file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-97
@@ -1,97 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for illegal privilege elevation.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 2f873b1f-6352-4844-b7b9-b419f09a42c7
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Privilege Elevation via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is setting highest privileges to malicious entities.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Privilege Escalation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is setting highest privileges to malicious entities. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1134
|
||||
- T1548
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal privilege elevation detections
|
||||
file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
|
||||
name: Illegal Privilege Elevation via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-100
@@ -1,100 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for illegal control over services and processes,
|
||||
including the authentication service.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: aaf3adf1-73e1-4477-b4ee-3771898964f1
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Service and Process Control via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line,
|
||||
/(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,
|
||||
/(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true
|
||||
OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Service Abuse
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is controlling computer's processess and services. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1106
|
||||
- T1569
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal service and process control detections
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
|
||||
name: Illegal Service and Process Control via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-110
@@ -1,110 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegal control of services
|
||||
and processes, such as installing or spoofing of malicious services, injecting malicious
|
||||
code in DLLs and EXEs, invoking shell code and WMI commands, modifying access to
|
||||
service objects, etc.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 0e910e5b-309d-4bc3-8af2-0030c02aa353
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Service and Process Control via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true
|
||||
OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line,
|
||||
/(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line,
|
||||
/(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true
|
||||
)
|
||||
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Service Abuse
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1106
|
||||
- T1569
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal service and process control detections
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
|
||||
name: Illegal Service and Process Control via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-62
@@ -1,62 +0,0 @@
|
||||
author: Xiao Lin, Splunk
|
||||
datamodel: []
|
||||
date: '2020-08-25'
|
||||
description: Malicious mails can conduct phishing that induces readers to open attachment,
|
||||
click links or trigger third party service. This detect uses Natural Language Processing
|
||||
(NLP) approach to analyze an email message's content (Sender, Subject and Body)
|
||||
and judge whether it is a phishing email. The detection adopts a deep learning (neural
|
||||
network) model that employs character level embeddings plus LSTM layers to perform
|
||||
classification. The model is pre-trained and then published as ONNX format. Current
|
||||
sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json
|
||||
User are expected to re-train the model by combining with their own training data
|
||||
for better accuracy using the provided model file (SMLE notebook). DSP pipeline
|
||||
then processes the email message and passes it as an event to Apply ML Models function,
|
||||
which returns the probability of a phishing email. Current implementation assumes
|
||||
the email is fed to DSP in JSON format contains at least email's sender, subject
|
||||
and its message body, including reply content, if any.
|
||||
how_to_implement: Events are fed to DSP contains at least email's sender, subject
|
||||
and its message body.
|
||||
id: 4b237388-dfa1-41a6-91d4-4de2d598376f
|
||||
known_false_positives: Because of imbalance of anomaly data in training, the model
|
||||
will less likely report false positive. Instead, the model is more prone to false
|
||||
negative. Current best recall score is ~85%
|
||||
name: Phishing Email Detection by Machine Learning Method - SSA
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event,
|
||||
"From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", "
|
||||
"), " ", ucast(map_get(input_event, "Content"), "string", " "), " "),
|
||||
_time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={"
|
||||
": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40,
|
||||
")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49,
|
||||
"2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58,
|
||||
";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67,
|
||||
"D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76,
|
||||
"M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85,
|
||||
"V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94,
|
||||
"_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g":
|
||||
103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o":
|
||||
111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w":
|
||||
119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in
|
||||
= for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i,
|
||||
1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8"
|
||||
path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out,
|
||||
0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD",
|
||||
body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();'
|
||||
tags:
|
||||
cis20:
|
||||
- CIS 8
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1566
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
risk_severity: low
|
||||
security_domain: mail server
|
||||
type: Anomaly
|
||||
version: 1
|
||||
Vendored
-96
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-04'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules that facilitate access probing with admin
|
||||
credentials as well as probing access to system services.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: d405af5d-99f1-45af-8dfb-b8f98b764247
|
||||
known_false_positives: None identified.
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is probing access with stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true
|
||||
OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Privilege Escalation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is probing access with stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit
|
||||
test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test access probing with stolen credentials detections
|
||||
file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,88 +0,0 @@
|
||||
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: An attacker may use LOLBAS tools spawned from vulnerable applications
|
||||
not typically used by system administrators. This analytic leverages the Splunk
|
||||
Streaming ML DSP plugin to find rare parent/child relationships. The list of application
|
||||
has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
|
||||
id: cf090c78-bcc6-11eb-8529-0242ac130003
|
||||
known_false_positives: Some custom tools used by administrators could be used rarely
|
||||
to launch remotely applications. This might trigger false positives at the beginning
|
||||
when it has not collected yet enough data to construct the baseline.
|
||||
name: Rare Parent-Child Process Relationship
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
|
||||
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
|
||||
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
|
||||
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
|
||||
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
|
||||
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
|
||||
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
|
||||
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
|
||||
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
|
||||
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
|
||||
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
|
||||
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
|
||||
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
|
||||
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
|
||||
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
|
||||
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
|
||||
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
|
||||
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
|
||||
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
|
||||
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
|
||||
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
|
||||
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
|
||||
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
|
||||
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
|
||||
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
|
||||
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
|
||||
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
|
||||
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
|
||||
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
|
||||
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
|
||||
window=604800000L | where label AND input > mean | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
|
||||
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
|
||||
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
|
||||
cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1203
|
||||
- T1059
|
||||
- T1053
|
||||
- T1072
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: Anomaly
|
||||
version: 2
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of accounts and groups and access
|
||||
to them.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and using specific accounts and groups.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and using specific accounts and groups.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1087
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-109
@@ -1,109 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover accounts, groups and policies
|
||||
that can be accessed or taken over.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 63422f8e-766c-468f-8133-2ba6795e263b
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and using specific accounts, groups
|
||||
and policies, such as the last logged on account, a local Net group, etc. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-LastLoggedOn/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and using specific accounts, groups
|
||||
and policies, such as the last logged on account, a local Net group, etc. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1087
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules for reconnaissance and access to elements
|
||||
of Active Directory infrastructure, such as domain identifiers, AD sites and forests,
|
||||
and trust relations.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: db08ac40-ee14-43e9-9a75-dddd059ef812
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is seaching for or accessing Active Directory objects
|
||||
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is seaching for or accessing Active Directory objects
|
||||
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1199
|
||||
- T1482
|
||||
- T1590
|
||||
- T1591
|
||||
- T1595
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover computers, servers and domains
|
||||
that can be accessed or taken over.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is seaching for or accessing domain controllers,
|
||||
computers, file servers, etc. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is seaching for or accessing domain controllers, computers,
|
||||
file servers, etc. Operation is performed at the device $dest_device_id$, by the
|
||||
account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592
|
||||
- T1590
|
||||
- T1087
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-81
@@ -1,81 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of computers and servers and access
|
||||
to them.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Computers via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is collecting information about computers. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::ServerInfo/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is collecting information about computers. Operation is
|
||||
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover and access operating system
|
||||
elements, such as processes, services, registry locations, security packages and
|
||||
files.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and tapping into ongoing processes,
|
||||
mounted drives or other operating system elements. Operation is performed at the
|
||||
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-RegistryMountedDrive/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and tapping into ongoing processes,
|
||||
mounted drives or other operating system elements. Operation is performed at the
|
||||
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1057
|
||||
- T1083
|
||||
- T1592.002
|
||||
- T1046
|
||||
- T1012
|
||||
- T1007
|
||||
- T1047
|
||||
- T1592
|
||||
- T1518
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-80
@@ -1,80 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery and access to services and processes.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 0243d37c-57c1-4182-bfd1-39b212255fc8
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Processes and Services via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is listing processes and services. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is listing processes and services. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1007
|
||||
- T1046
|
||||
- T1057
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery and access to network shares.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Shared Resources via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::share/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Lateral Movement
|
||||
- Stage:Collection
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover and access network and distributed
|
||||
file system shares.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 6b7ca431-6b1e-4b40-9589-21cb368e369e
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Shared Resources via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Lateral Movement
|
||||
- Stage:Collection
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-101
@@ -1,101 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules that discover opportunities for malicious
|
||||
access and persistence. Some examples include access to admin accounts, weak access
|
||||
control policies, landing paths for dropping malicious software or data to exfiltrate,
|
||||
registry locations to land autorun parameters, task scheduling opportunities, as
|
||||
well as services and system files that can be compromised.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for an entry point into the infrastructure,
|
||||
such as local admin accounts, opportunities to hijack processes, unattended install
|
||||
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-UnquotedService/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for an entry point into the infrastructure,
|
||||
such as local admin accounts, opportunities to hijack processes, unattended install
|
||||
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
- T1068
|
||||
- T1078
|
||||
- T1543
|
||||
- T1547
|
||||
- T1574
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules for reconnaissance of connectivity.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Connectivity via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is performing port scans or searching for various
|
||||
connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is performing port scans or searching for various connectivity
|
||||
details such as DNS data, proxies, or ongoing RDP connections. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-91
@@ -1,91 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies reconnaissance of credential stores and use of CryptoAPI services by
|
||||
Mimikatz modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 5facee5b-79e4-47ab-b0e6-c625acc0554f
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Credential Stores and Services via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and accessing credential stores. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line,
|
||||
/(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true
|
||||
OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and accessing credential stores. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1590.001
|
||||
- T1078
|
||||
- T1589.001
|
||||
- T1590
|
||||
- T1068
|
||||
- T1589
|
||||
- T1590.003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-83
@@ -1,83 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules for assessment of presence of defensive tools.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 24b4e659-63a2-4e7b-89ac-87dd659c7110
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Defensive Tools via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is looking for presence of anti virus software.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-AVSignature/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 40
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is looking for presence of anti virus software. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592.002
|
||||
- T1595.002
|
||||
- T1592
|
||||
- T1595
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 40
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-82
@@ -1,82 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules for assessment of privilege escalation opportunities.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: b9b4492c-2af8-449b-beb4-b1b78d963321
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is engaging its privilege escalation module. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Invoke-PrivescAudit/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is engaging its privilege escalation module. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of process or service hijacking
|
||||
opportunities via Microsoft Detours compatibility. Microsoft Detours is an open
|
||||
source library for intercepting, monitoring and instrumenting binary functions on
|
||||
Microsoft Windows. Detours intercepts Win32 functions by re-writing the in-memory
|
||||
code for target functions. The Detours package also contains utilities to attach
|
||||
arbitrary DLLs and data segments called payloads to any Win32 binary.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: fc5c1cbd-7494-4314-aad2-458d6fd4fada
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
- https://en.wikipedia.org/wiki/Microsoft_Detours
|
||||
risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package
|
||||
that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)misc::detours/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is looking for and invoking Microsoft Detours package
|
||||
that enables spoofing of in-memory code. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1543
|
||||
- T1055
|
||||
- T1574
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,106 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via DSInternals modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is accessing, using or setting Active Directory
|
||||
or Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
|
||||
OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Source:Cloud Data
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is accessing, using or setting Active Directory or
|
||||
Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via DSInternals modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
file_name: logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
|
||||
name: Setting Credentials via DSInternals modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via Mimikatz modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c8b84699-7652-4363-910f-efd1ca82f780
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is accessing, using or setting account credentials.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is accessing, using or setting account credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
|
||||
name: Setting Credentials via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via PowerSploit modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 07b2a501-f967-4ddc-9f56-2dce46dfce44
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is setting passwords on Active Directory accounts.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Set-DomainUserPassword/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is setting passwords on Active Directory accounts.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
|
||||
name: Setting Credentials via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,87 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-06'
|
||||
description: Command lines that are extremely long may be indicative of malicious
|
||||
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
|
||||
to help identify command lines with lengths that are unusual for a given user. This
|
||||
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
|
||||
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
|
||||
lines.
|
||||
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
|
||||
known_false_positives: This detection may flag suspiciously long command lines when
|
||||
there is not sufficient evidence (samples) for a given process that this detection
|
||||
is tracking; or when there is high variability in the length of the command line
|
||||
for the tracked process. Also, some legitimate applications may use long command
|
||||
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
|
||||
Attackers may use this technique to obfuscate their payloads.
|
||||
name: Unusually Long Command Line
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: A process $process_name$ with a long commandline $cmd_line$ executed
|
||||
in host $dest_device_id$
|
||||
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
|
||||
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
|
||||
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
|
||||
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
|
||||
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
|
||||
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
|
||||
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
|
||||
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 40
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ with a long commandline $cmd_line$ executed in
|
||||
host $dest_device_id$
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 12
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Unusually Long Command Line - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test unusually long command lines
|
||||
file: endpoint/ssa___unusually_long_command_line.yml
|
||||
name: Unusually Long Command Line
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
Vendored
+1
-1
@@ -107,7 +107,7 @@ test:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:security
|
||||
source: WinEventLog:Security
|
||||
file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
|
||||
name: Windows Curl Upload to Remote Destination
|
||||
pass_condition: '@count_gt(0)'
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Unusually Long Command Line Unit Test
|
||||
tests:
|
||||
- name: Unusually Long Command Line
|
||||
file: endpoint/unusually_long_command_line.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
Reference in New Issue
Block a user