admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2337 from splunk/100_percent_pass_rate

Browse Source 
100 percent pass rate
This commit is contained in:
Bhavin Patel
2022-08-25 18:25:35 -05:00
committed by GitHub
parent 0c0fc259b6 474ea41291
commit cfaf15a916
11 changed files with 89 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/detection-testing.yml
+6 -6
View File
@@ -50,8 +50,8 @@ jobs:
- name: Checkout Repo
uses: actions/checkout@v2
with:
ref: develop
#with:
# ref: develop
@@ -139,8 +139,8 @@ jobs:
- name: Checkout Repo
uses: actions/checkout@v2
with:
ref: develop
#with:
# ref: develop
- name: Download artifacts
uses: actions/download-artifact@v2
@@ -198,8 +198,8 @@ jobs:
- name: Checkout Repo
uses: actions/checkout@v2
with:
ref: develop
#with:
# ref: develop
- name: Download artifacts
uses: actions/download-artifact@v2
detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+4 -4
View File
@@ -1,8 +1,8 @@
name: AWS ECR Container Scanning Findings Low Informational Unknown
id: cbc95e44-7c22-443f-88fd-0424478f5589
version: 1
date: '2021-08-17'
author: Patrick Bareiss, Splunk
date: '2022-08-25'
author: Patrick Bareiss, Eric McGinnis Splunk
type: Hunting
datamodel: []
description: This search looks for AWS CloudTrail events from AWS Elastic Container
@@ -10,12 +10,12 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
with the results.
search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
| spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
findings | spath input=findings| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
= finding_name.", ".finding_description | eval phase="release" | eval severity="low"
| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase,
eventSource, imageDigest, repositoryName, userName, src_ip, finding, phase,
severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+19 -13
View File
@@ -1,8 +1,8 @@
name: Detect AWS Console Login by User from New City
id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
version: 2
date: '2022-08-25'
author: Bhavin Patel, Eric McGinnis Splunk
type: Hunting
datamodel:
- Authentication
@@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats min(firstTime) AS earliestseen by user City | fields earliestseen user City]
| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously
Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src
| `drop_dm_object_name(Authentication)`
| rename City as justSeenCity
| table firstTime lastTime user justSeenCity
| join user type=outer
[| inputlookup previously_seen_users_console_logins
| rename City as previouslySeenCity
| stats min(firstTime) AS earliestseen by user previouslySeenCity
| fields earliestseen user previouslySeenCity]
| eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City")
| where userCity = "New City"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime lastTime user previouslySeenCity justSeenCity userCity
| `detect_aws_console_login_by_user_from_new_city_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+19 -12
View File
@@ -1,8 +1,8 @@
name: Detect AWS Console Login by User from New Country
id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
version: 2
date: '2022-08-25'
author: Bhavin Patel, Eric McGinnis Splunk
type: Hunting
datamodel:
- Authentication
@@ -12,15 +12,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
The alert is fired if the user has logged into the console for the first time within
the last hour
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats min(firstTime) AS earliestseen by user Country | fields earliestseen user
Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New
Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h")
OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`'
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src
| `drop_dm_object_name(Authentication)`
| rename Country as justSeenCountry
| table firstTime lastTime user justSeenCountry
| join user type=outer
[| inputlookup previously_seen_users_console_logins
| rename Country as previouslySeenCountry
| stats min(firstTime) AS earliestseen by user previouslySeenCountry
| fields earliestseen user previouslySeenCountry]
| eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country")
| where userCountry = "New Country"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime lastTime user previouslySeenCountry justSeenCountry userCountry
| `detect_aws_console_login_by_user_from_new_country_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+19 -13
View File
@@ -1,8 +1,8 @@
name: Detect AWS Console Login by User from New Region
id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
version: 1
date: '2020-10-07'
author: Bhavin Patel, Splunk
version: 2
date: '2022-08-25'
author: Bhavin Patel, Eric McGinnis Splunk
type: Hunting
datamodel:
- Authentication
@@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
file of previously seen users (by ARN values) who have logged into the console.
The alert is fired if the user has logged into the console for the first time within
the last hour
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins
| stats min(firstTime) AS earliestseen by user Region | fields earliestseen user
Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously
Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region"
AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`'
search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
| iplocation Authentication.src
| `drop_dm_object_name(Authentication)`
| rename Region as justSeenRegion
| table firstTime lastTime user justSeenRegion
| join user type=outer
[| inputlookup previously_seen_users_console_logins
| rename Region as previouslySeenRegion
| stats min(firstTime) AS earliestseen by user previouslySeenRegion
| fields earliestseen user previouslySeenRegion]
| eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region")
| where userRegion= "New Region"
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime lastTime user previouslySeenRegion justSeenRegion userRegion
| `detect_aws_console_login_by_user_from_new_region_filter`'
how_to_implement: You must install and configure the Splunk Add-on for AWS (version
5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
to the Authentication data model for cloud use cases. Run the `Previously Seen Users
detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Detect Excessive Account Lockouts From Endpoint
id: c026e3dd-7e18-4abb-8f41-929e836efe74
version: 5
date: '2020-11-09'
version: 6
date: '2022-08-25'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
@@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high
of account lockouts in a short period.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where
nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest
All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result
|`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`'
how_to_implement: "You must ingest your Windows security event logs in the `Change`\
detections/endpoint/detect_excessive_user_account_lockouts.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Detect Excessive User Account Lockouts
id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
version: 3
date: '2020-07-21'
version: 4
date: '2022-08-25'
author: David Dorsey, Splunk
type: Anomaly
datamodel:
@@ -9,8 +9,8 @@ datamodel:
description: This search detects user accounts that have been locked out a relatively
high number of times in a short period.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
as lastTime from datamodel=Change.All_Changes where All_Changes.result="*locked out*"
by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
|`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
how_to_implement: ou must ingest your Windows security event logs in the `Change`
detections/endpoint/mshtml_module_load_in_office_product.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: MSHTML Module Load in Office Product
id: 5f1c168e-118b-11ec-84ff-acde48001122
version: 2
date: '2022-06-01'
version: 3
date: '2022-08-25'
author: Michael Haag, Mauricio Velazco, Splunk
type: TTP
datamodel:
@@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in
malicious document will load ActiveX, which activates the MSHTML component. The
vulnerability resides in the MSHTML component. During triage, identify parallel
processes and capture any file modifications for analysis.
search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
detections/endpoint/office_document_creating_schedule_task.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Office Document Creating Schedule Task
id: cc8b7b74-9d0f-11eb-8342-acde48001122
version: 1
date: '2021-04-14'
version: 2
date: '2022-08-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -19,9 +19,9 @@ description: this search detects a potential malicious office document that crea
source. Was it schtasks.exe or via TaskService? Review the job created and the Command
to be executed. Capture any artifacts on disk and review. Identify any parallel
processes within the same timeframe to identify source.'
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `office_document_creating_schedule_task_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Powershell Remote Thread To Known Windows Process
id: ec102cb2-a0f5-11eb-9b38-acde48001122
version: 1
date: '2021-04-19'
version: 2
date: '2022-08-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,7 +11,7 @@ description: this search is designed to detect suspicious powershell process tha
CreateRemoteThread. This technique is seen in several malware like trickbot and
offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
execute reverse shell to c2 and download another payload
search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe")
TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress
detections/endpoint/windows_installutil_credential_theft.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Windows InstallUtil Credential Theft
id: ccfeddec-43ec-11ec-b494-acde48001122
version: 2
date: '2022-06-01'
version: 3
date: '2022-08-25'
author: Michael Haag, Mauricio Velazo, Splunk
type: TTP
datamodel:
@@ -21,9 +21,9 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
During triage review resulting network connections, file modifications, and parallel
processes. Capture any artifacts and review further.'
search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
search: '`sysmon` EventCode=7 parent_process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
"*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_installutil_credential_theft_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting