Branch was auto-updated.

detections/endpoint/getlocaluser_with_powershell.yml

@@ -0,0 +1,54 @@
+name: GetLocalUser with PowerShell
+id: 85fae8fa-0427-11ec-8b78-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users.  
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-LocalUser*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
+  
+  

detections/endpoint/getlocaluser_with_powershell_script_block.yml

@@ -0,0 +1,49 @@
+name: GetLocalUser with PowerShell Script Block
+id: 2e891cbe-0426-11ec-9c9c-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. 
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*Get-LocalUser*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `getlocaluser_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/getwmiobject_user_account_with_powershell.yml

@@ -0,0 +1,51 @@
+name: GetWmiObject User Account with PowerShell
+id: b44f6ac6-0429-11ec-87e9-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users.  
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml

@@ -0,0 +1,50 @@
+name: GetWmiObject User Account with PowerShell Script Block
+id: 640b0eda-0429-11ec-accd-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used 
+  to return a list of all local users. 
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon 
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/local_account_discovery_with_net.yml

@@ -0,0 +1,51 @@
+name: Local Account Discovery with Net
+id: 5d0d4830-0133-11ec-bae3-acde48001122
+version: 1
+date: '2021-08-19'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line
+  arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. 
+  Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") 
+  (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

detections/endpoint/local_account_discovery_with_wmic.yml

@@ -0,0 +1,51 @@
+name: Local Account Discovery With Wmic
+id: 4902d7aa-0134-11ec-9d65-acde48001122
+version: 1
+date: '2021-08-19'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `wmic.exe` with command-line
+  arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. 
+  Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim

stories/active_directory_discovery.yml

@@ -0,0 +1,36 @@
+name: Active Directory Discovery
+id: 8460679c-2b21-463e-b381-b813417c32f2
+version: 1
+date: '2021-08-20'
+author: Mauricio Velazco, Splunk
+type: batch
+description: Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.
+narrative: 'Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries 
+with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\ 
+
+Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better
+understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, 
+domain controllers, network shares, group policy objects, domain trusts, etc.'
+references:
+- https://attack.mitre.org/tactics/TA0007/
+- https://adsecurity.org/?p=2535
+- https://attack.mitre.org/techniques/T1087/001/
+- https://attack.mitre.org/techniques/T1087/002/
+- https://attack.mitre.org/techniques/T1087/003/
+- https://attack.mitre.org/techniques/T1482/
+- https://attack.mitre.org/techniques/T1201/
+- https://attack.mitre.org/techniques/T1069/001/
+- https://attack.mitre.org/techniques/T1069/002/
+- https://attack.mitre.org/techniques/T1018/
+- https://attack.mitre.org/techniques/T1049/
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/getlocaluser_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: GetLocalUser with PowerShell Unit Test
+tests:
+- name: GetLocalUser with PowerShell
+  file: endpoint/getlocaluser_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/getlocaluser_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: GetLocalUser with PowerShell Script Block Unit Test
+tests:
+- name: GetLocalUser with PowerShell Script Block
+  file: endpoint/getlocaluser_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/getwmiobject_user_account_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: GetWmiObject User Account with PowerShell Unit Test
+tests:
+- name: GetWmiObject User Account with PowerShell
+  file: endpoint/getwmiobject_user_account_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: GetWmiObject User Account with PowerShell Script Block Unit Test
+tests:
+- name: GetWmiObject User Account with PowerShell Script Block
+  file: endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog

tests/endpoint/local_account_discovery_with_net.test.yml

@@ -0,0 +1,12 @@
+name: Local Account Discovery with Net Unit Test
+tests:
+- name: Local Account Discovery with Net
+  file: endpoint/local_account_discovery_with_net.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/local_account_discovery_with_wmic.test.yml

@@ -0,0 +1,12 @@
+name: Local Account Discovery With Wmic Unit Test
+tests:
+- name: Local Account Discovery With Wmic
+  file: endpoint/local_account_discovery_with_wmic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog