diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml index a2bba1b154..0bd7a20c76 100644 --- a/.github/workflows/detection-testing.yml +++ b/.github/workflows/detection-testing.yml @@ -50,8 +50,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 - with: - ref: develop + #with: + # ref: develop @@ -139,8 +139,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 - with: - ref: develop + #with: + # ref: develop - name: Download artifacts uses: actions/download-artifact@v2 @@ -198,8 +198,8 @@ jobs: - name: Checkout Repo uses: actions/checkout@v2 - with: - ref: develop + #with: + # ref: develop - name: Download artifacts uses: actions/download-artifact@v2 diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index 9345c11f36..4052cac446 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -1,8 +1,8 @@ name: AWS ECR Container Scanning Findings Low Informational Unknown id: cbc95e44-7c22-443f-88fd-0424478f5589 version: 1 -date: '2021-08-17' -author: Patrick Bareiss, Splunk +date: '2022-08-25' +author: Patrick Bareiss, Eric McGinnis Splunk type: Hunting datamodel: [] description: This search looks for AWS CloudTrail events from AWS Elastic Container @@ -10,12 +10,12 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai with the results. search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand - findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) + findings | spath input=findings| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN") | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | eval phase="release" | eval severity="low" | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, - eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase, + eventSource, imageDigest, repositoryName, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 5f778e89d5..e1f112c9d6 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -1,8 +1,8 @@ name: Detect AWS Console Login by User from New City id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a -version: 1 -date: '2020-10-07' -author: Bhavin Patel, Splunk +version: 2 +date: '2022-08-25' +author: Bhavin Patel, Eric McGinnis Splunk type: Hunting datamodel: - Authentication @@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src - | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table - firstTime lastTime user City | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City] - | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously - Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") - OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND - userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime user City userStatus userCity | `detect_aws_console_login_by_user_from_new_city_filter`' +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src + | iplocation Authentication.src + | `drop_dm_object_name(Authentication)` + | rename City as justSeenCity + | table firstTime lastTime user justSeenCity + | join user type=outer + [| inputlookup previously_seen_users_console_logins + | rename City as previouslySeenCity + | stats min(firstTime) AS earliestseen by user previouslySeenCity + | fields earliestseen user previouslySeenCity] + | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") + | where userCity = "New City" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime lastTime user previouslySeenCity justSeenCity userCity + | `detect_aws_console_login_by_user_from_new_city_filter`' how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index ba41bc20f1..2f1fe53c8a 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -1,8 +1,8 @@ name: Detect AWS Console Login by User from New Country id: 67bd3def-c41c-4bf6-837b-ae196b4257c6 -version: 1 -date: '2020-10-07' -author: Bhavin Patel, Splunk +version: 2 +date: '2022-08-25' +author: Bhavin Patel, Eric McGinnis Splunk type: Hunting datamodel: - Authentication @@ -12,15 +12,22 @@ description: This search looks for AWS CloudTrail events wherein a console login The alert is fired if the user has logged into the console for the first time within the last hour search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src - | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table - firstTime lastTime user Country | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user - Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New - Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") - OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" - AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime user Country userStatus userCountry | `detect_aws_console_login_by_user_from_new_country_filter`' + where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src + | iplocation Authentication.src + | `drop_dm_object_name(Authentication)` + | rename Country as justSeenCountry + | table firstTime lastTime user justSeenCountry + | join user type=outer + [| inputlookup previously_seen_users_console_logins + | rename Country as previouslySeenCountry + | stats min(firstTime) AS earliestseen by user previouslySeenCountry + | fields earliestseen user previouslySeenCountry] + | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") + | where userCountry = "New Country" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime lastTime user previouslySeenCountry justSeenCountry userCountry + | `detect_aws_console_login_by_user_from_new_country_filter`' how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index cfe68f8a00..f6ac8156d4 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -1,8 +1,8 @@ name: Detect AWS Console Login by User from New Region id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 -version: 1 -date: '2020-10-07' -author: Bhavin Patel, Splunk +version: 2 +date: '2022-08-25' +author: Bhavin Patel, Eric McGinnis Splunk type: Hunting datamodel: - Authentication @@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication - where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src - | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table - firstTime lastTime user Region | join user type=outer [| inputlookup previously_seen_users_console_logins - | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user - Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously - Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") - OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" - AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime lastTime user Region userStatus userRegion | `detect_aws_console_login_by_user_from_new_region_filter`' +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src + | iplocation Authentication.src + | `drop_dm_object_name(Authentication)` + | rename Region as justSeenRegion + | table firstTime lastTime user justSeenRegion + | join user type=outer + [| inputlookup previously_seen_users_console_logins + | rename Region as previouslySeenRegion + | stats min(firstTime) AS earliestseen by user previouslySeenRegion + | fields earliestseen user previouslySeenRegion] + | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") + | where userRegion= "New Region" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime lastTime user previouslySeenRegion justSeenRegion userRegion + | `detect_aws_console_login_by_user_from_new_region_filter`' how_to_implement: You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index d9c4aa587a..5469f9c712 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -1,7 +1,7 @@ name: Detect Excessive Account Lockouts From Endpoint id: c026e3dd-7e18-4abb-8f41-929e836efe74 -version: 5 -date: '2020-11-09' +version: 6 +date: '2022-08-25' author: David Dorsey, Splunk type: Anomaly datamodel: @@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high of account lockouts in a short period. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where - nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest - All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| + All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result + |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`' how_to_implement: "You must ingest your Windows security event logs in the `Change`\ diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 2f6f1cbfc6..50e2d877ae 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -1,7 +1,7 @@ name: Detect Excessive User Account Lockouts id: 95a7f9a5-6096-437e-a19e-86f42ac609bd -version: 3 -date: '2020-07-21' +version: 4 +date: '2022-08-25' author: David Dorsey, Splunk type: Anomaly datamodel: @@ -9,8 +9,8 @@ datamodel: description: This search detects user accounts that have been locked out a relatively high number of times in a short period. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management - All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")` + as lastTime from datamodel=Change.All_Changes where All_Changes.result="*locked out*" + by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`' how_to_implement: ou must ingest your Windows security event logs in the `Change` diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index 10ec4eb2d1..803050cfe7 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -1,7 +1,7 @@ name: MSHTML Module Load in Office Product id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 2 -date: '2022-06-01' +version: 3 +date: '2022-08-25' author: Michael Haag, Mauricio Velazco, Splunk type: TTP datamodel: @@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in malicious document will load ActiveX, which activates the MSHTML component. The vulnerability resides in the MSHTML component. During triage, identify parallel processes and capture any file modifications for analysis. -search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") +search: '`sysmon` EventID=7 parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)` diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 13636ffc50..4e50acae24 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -1,7 +1,7 @@ name: Office Document Creating Schedule Task id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 1 -date: '2021-04-14' +version: 2 +date: '2022-08-25' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -19,9 +19,9 @@ description: this search detects a potential malicious office document that crea source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") +search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime - values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name + values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' how_to_implement: To successfully implement this search, you need to be ingesting diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 55fb743ab0..d7483dca48 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -1,7 +1,7 @@ name: Powershell Remote Thread To Known Windows Process id: ec102cb2-a0f5-11eb-9b38-acde48001122 -version: 1 -date: '2021-04-19' +version: 2 +date: '2022-08-25' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,7 +11,7 @@ description: this search is designed to detect suspicious powershell process tha CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload -search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") +search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe") | stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index d0c6050e63..dd113911d4 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -1,7 +1,7 @@ name: Windows InstallUtil Credential Theft id: ccfeddec-43ec-11ec-b494-acde48001122 -version: 2 -date: '2022-06-01' +version: 3 +date: '2022-08-25' author: Michael Haag, Mauricio Velazo, Splunk type: TTP datamodel: @@ -21,9 +21,9 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further.' -search: '`sysmon` EventCode=7 process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", +search: '`sysmon` EventCode=7 parent_process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime - by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer + by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`' how_to_implement: To successfully implement this search, you need to be ingesting