admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

PEX-33: fix JSON output dir

Browse Source
This commit is contained in:
Danny Leung
2021-10-30 00:58:01 -07:00
parent a6dd62edbc aa9f7e0d13
commit d0e998075a
1016 changed files with 891357 additions and 665722 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-and-validate.yml
+1 -2
View File
@@ -623,8 +623,7 @@ jobs:
aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"
aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml"
aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml"
aws s3 cp playbooks s3://security-content/playbooks --recursive --exclude "*" --include "*.yml"
aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml"
aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
automated_detection_testing/requirements.txt
+15 -15
View File
@@ -1,4 +1,4 @@
ansible==3.4.0
ansible==4.7.0
ansible-runner==2.0.2
apipkg==1.5
aspy.yaml==1.3.0
@@ -7,31 +7,31 @@ attackcti==0.3.4.3
attrs==21.2.0
azure-common==1.1.27
azure-core==1.18.0
azure-mgmt-compute==23.0.0
azure-identity==1.6.1
azure-mgmt-compute==20.0.0
azure-mgmt-core==1.2.1
azure-mgmt-network==19.0.0
azure-mgmt-resource==17.0.0
bcrypt==3.2.0
boto3==1.18.38
botocore==1.20.105
botocore==1.22.5
certifi==2021.5.30
cffi==1.14.5
cffi==1.15.0
cfgv==3.3.0
chardet==4.0.0
colorama==0.4.4
configparser==5.0.2
contextlib2==0.6.0.post1
Deprecated==1.2.12
Deprecated==1.2.13
dnspython==2.1.0
docutils==0.17.1
docutils==0.18
execnet==1.9.0
gitdb==4.0.5
GitPython==3.1.18
GitPython==3.1.24
identify==2.2.10
idna==2.8
idna==3.3
importlib-metadata==4.0.1
Jinja2==3.0.0
Jinja2==3.0.2
jmespath==0.10.0
lockfile==0.12.2
MarkupSafe==2.0.1
@@ -46,7 +46,7 @@ path.py==12.5.0
pexpect==4.8.0
pluggy==0.13.1
pre-commit==2.15.0
protobuf==3.17.0
protobuf==3.18.1
psutil==5.8.0
ptyprocess==0.7.0
py==1.10.0
@@ -57,15 +57,15 @@ PyJWT==2.1.0
PyNaCl==1.4.0
pyparsing==2.4.7
pyperclip==1.8.2
pytest==6.2.4
pytest==6.2.5
python-daemon==2.3.0
python-dateutil==2.8.1
python-terraform==0.10.1
pywinrm==0.4.2
PyYAML==5.4.1
PyYAML==6.0
requests==2.25.1
requests-ntlm==1.1.0
s3transfer==0.4.2
s3transfer==0.5.0
six==1.16.0
smmap==3.0.5
splunk-sdk==1.6.16
@@ -73,10 +73,10 @@ tabulate==0.8.9
termcolor==1.1.0
toml==0.10.2
urllib3<1.26.8
virtualenv==20.4.6
virtualenv==20.9.0
wcwidth==0.2.5
wget==3.2
wrapt==1.12.1
wrapt==1.13.1
xmltodict==0.12.0
zipp==3.4.1
bin/doc_gen.py
+42 -46
View File
@@ -3,14 +3,24 @@ import yaml
import argparse
import sys
import re
from os import path, walk
from os import path, walk, remove
import json
from jinja2 import Environment, FileSystemLoader
import datetime
from stix2 import FileSystemSource
from stix2 import Filter
from pycvesearch import CVESearch
CVESSEARCH_API_URL = 'https://cve.circl.lu'
def get_cve_enrichment_new(cve_id):
cve = CVESearch(CVESSEARCH_API_URL)
result = cve.id(cve_id)
cve_enriched = dict()
cve_enriched['id'] = cve_id
cve_enriched['cvss'] = result['cvss']
cve_enriched['summary'] = result['summary']
return cve_enriched
def get_all_techniques(projects_path):
path_cti = path.join(projects_path,'cti/enterprise-attack')
@@ -162,7 +172,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
if t not in tactics:
tactics.append(t)
template = j2_env.get_template('doc_navigation_markdown.j2')
template = j2_env.get_template('doc_navigation.j2')
output_path = path.join(OUTPUT_DIR + '/_data/navigation.yml')
output = template.render(tactics=sorted(tactics), datamodels=sorted(datamodels), categories=sorted(category_names))
with open(output_path, 'w', encoding="utf-8") as f:
@@ -171,7 +181,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
# write navigation _pages
# for datamodels
template = j2_env.get_template('doc_navigation_pages_markdown.j2')
template = j2_env.get_template('doc_navigation_pages.j2')
for datamodel in sorted(datamodels):
output_path = path.join(OUTPUT_DIR + '/_pages/' + datamodel.lower().replace(" ", "_") + ".md")
output = template.render(tag=datamodel)
@@ -187,7 +197,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
messages.append("doc_gen.py wrote _page for: {1} structure to: {0}".format(output_path, tactic))
# for story categories
template = j2_env.get_template('doc_navigation_story_pages_markdown.j2')
template = j2_env.get_template('doc_navigation_story_pages.j2')
for category in categories:
output_path = path.join(OUTPUT_DIR + '/_pages/' + category['name'].lower().replace(" ", "_") + ".md")
output = template.render(category=category)
@@ -196,7 +206,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
messages.append("doc_gen.py wrote _page for: {0} structure to: {1}".format(category['name'], output_path))
# write stories listing markdown
template = j2_env.get_template('doc_story_page_markdown.j2')
template = j2_env.get_template('doc_story_page.j2')
output_path = path.join(OUTPUT_DIR + '/_pages/stories.md')
output = template.render(stories=sorted_stories)
with open(output_path, 'w', encoding="utf-8") as f:
@@ -204,7 +214,7 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
messages.append("doc_gen.py wrote _pages for story to: {0}".format(output_path))
# write stories markdown
template = j2_env.get_template('doc_stories_markdown.j2')
template = j2_env.get_template('doc_stories.j2')
for story in sorted_stories:
file_name = story['name'].lower().replace(" ","_") + '.md'
output_path = path.join(OUTPUT_DIR + '/_stories/' + file_name)
@@ -213,14 +223,6 @@ def generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, sorted_de
f.write(output)
messages.append("doc_gen.py wrote {0} story documentation in markdown to: {1}".format(len(sorted_stories),OUTPUT_DIR + '/_stories/'))
# write wikimarkup
template = j2_env.get_template('doc_stories_wiki.j2')
output_path = path.join(OUTPUT_DIR + '/stories.wiki')
output = template.render(categories=categories, time=datetime.datetime.now())
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
messages.append("doc_gen.py wrote {0} stories documentation in mediawiki to: {1}".format(len(stories),output_path))
return sorted_stories, messages
@@ -256,6 +258,14 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
mitre_attacks.append(mitre_attack)
detection_yaml['mitre_attacks'] = mitre_attacks
# enrich the cve object
cves = []
if 'cve' in detection_yaml['tags']:
for cve_id in detection_yaml['tags']['cve']:
cve = get_cve_enrichment_new(cve_id)
cves.append(cve)
detection_yaml['cve'] = cves
# grab the kind
detection_yaml['kind'] = manifest_file.split('/')[-2]
@@ -275,7 +285,7 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
trim_blocks=False, autoescape=True)
# write markdown
template = j2_env.get_template('doc_detections_markdown.j2')
template = j2_env.get_template('doc_detections.j2')
for detection in sorted_detections:
file_name = detection['date'] + "-" + detection['name'].lower().replace(" ","_") + '.md'
output_path = path.join(OUTPUT_DIR + '/_posts/' + file_name)
@@ -285,38 +295,13 @@ def generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, attack, messag
messages.append("doc_gen.py wrote {0} detections documentation in markdown to: {1}".format(len(sorted_detections),OUTPUT_DIR + '/_posts/'))
# write markdown detection page
template = j2_env.get_template('doc_detection_page_markdown.j2')
template = j2_env.get_template('doc_detection_page.j2')
output_path = path.join(OUTPUT_DIR + '/_pages/detections.md')
output = template.render(detections=sorted_detections, time=datetime.datetime.now())
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
messages.append("doc_gen.py wrote detections.md page to: {0}".format(output_path))
#sort detections by kind into categories
kinds = []
kind_names = set()
for detection in sorted_detections:
kind_names.add(detection['kind'])
for kind_name in sorted(kind_names):
new_kind = {}
new_kind['name'] = kind_name
new_kind['detections'] = []
kinds.append(new_kind)
for detection in sorted_detections:
for kind in kinds:
if kind['name'] == detection['kind']:
kind['detections'].append(detection)
# write wikimarkup
template = j2_env.get_template('doc_detections_wiki.j2')
output_path = path.join(OUTPUT_DIR + '/detections.wiki')
output = template.render(kinds=kinds, time=datetime.datetime.now())
with open(output_path, 'w', encoding="utf-8") as f:
f.write(output)
messages.append("doc_gen.py wrote {0} detections documentation in mediawiki to: {1}".format(len(detections),output_path))
return sorted_detections, messages
def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, messages, VERBOSE):
@@ -348,7 +333,7 @@ def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detectio
trim_blocks=False, autoescape=True)
# write markdown
template = j2_env.get_template('doc_playbooks_markdown.j2')
template = j2_env.get_template('doc_playbooks.j2')
for playbook in sorted_playbooks:
file_name = playbook['name'].lower().replace(" ","_") + '.md'
output_path = path.join(OUTPUT_DIR + '/_playbooks/' + file_name)
@@ -358,7 +343,7 @@ def generate_doc_playbooks(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, sorted_detectio
messages.append("doc_gen.py wrote {0} playbook documentation in markdown to: {1}".format(len(sorted_playbooks),OUTPUT_DIR + '/_playbooks/'))
# write markdown detection page
template = j2_env.get_template('doc_playbooks_page_markdown.j2')
template = j2_env.get_template('doc_playbooks_page.j2')
output_path = path.join(OUTPUT_DIR + '/_pages/playbooks.md')
output = template.render(playbooks=sorted_playbooks, detections=sorted_detections, time=datetime.datetime.now())
with open(output_path, 'w', encoding="utf-8") as f:
@@ -374,7 +359,7 @@ def generate_doc_index(OUTPUT_DIR, TEMPLATE_PATH, sorted_detections, sorted_stor
trim_blocks=False, autoescape=True)
# write index updated metrics
template = j2_env.get_template('doc_index_markdown.j2')
template = j2_env.get_template('doc_index.j2')
output_path = path.join(OUTPUT_DIR + '/index.markdown')
output = template.render(detection_count=len(sorted_detections), story_count=len(sorted_stories), playbook_count=len(sorted_playbooks))
with open(output_path, 'w', encoding="utf-8") as f:
@@ -387,7 +372,7 @@ if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="Generates documentation from Splunk Security Content", epilog="""
This tool converts all Splunk Security Content detections, stories, workbooks and spec files into documentation. It builds both wiki markup (Splunk Docs) an markdown documentation.""")
This generates documention in the form of jekyll site research.splunk.com from Splunk Security Content yamls. """)
parser.add_argument("-p", "--path", required=True, help="path to security_content repo")
parser.add_argument("-o", "--output", required=True, help="path to the output directory for the docs")
parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
@@ -399,13 +384,24 @@ if __name__ == "__main__":
OUTPUT_DIR = args.output
VERBOSE = args.verbose
TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
if VERBOSE:
print("getting mitre enrichment data from cti")
techniques = get_all_techniques(REPO_PATH)
if VERBOSE:
print("wiping the {0}/_posts/* folder".format(OUTPUT_DIR))
try:
for root, dirs, files in walk(OUTPUT_DIR + '/_posts/'):
for file in files:
if file.endswith(".md"):
remove(OUTPUT_DIR + '/_posts/' + file)
except OSError as e:
print("error: %s : %s" % (file, e.strerror))
sys.exit(1)
messages = []
sorted_detections, messages = generate_doc_detections(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, messages, VERBOSE)
sorted_stories, messages = generate_doc_stories(REPO_PATH, OUTPUT_DIR, TEMPLATE_PATH, techniques, sorted_detections, messages, VERBOSE)
bin/generate.py
+11 -11
View File
@@ -67,7 +67,7 @@ def generate_transforms_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
trim_blocks=True)
trim_blocks=True)
template = j2_env.get_template('transforms.j2')
output_path = path.join(OUTPUT_PATH, 'default/transforms.conf')
output = template.render(lookups=sorted_lookups, time=utc_time)
@@ -230,7 +230,7 @@ def get_deployments(object, deployments):
for deployment in deployments:
for tag in object['tags'].keys():
if tag in deployment['tags'].keys():
if type(object['tags'][tag]) is str:
tag_array = [object['tags'][tag]]
@@ -325,7 +325,7 @@ def add_annotations(detection):
# changes to this data structure separate from the mappings generation
# @todo expose the JSON data structure for newer risk type
annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence']
annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve']
savedsearch_annotations = {}
for key in annotation_keys:
if key == 'mitre_attack':
@@ -364,7 +364,7 @@ def add_rba(detection):
# determine if is a user type, create risk
if entity['type'].lower() in risk_object_user_types:
for r in entity['role']:
if 'attacker' == r.lower() or 'victim' ==r.lower():
@@ -376,10 +376,10 @@ def add_rba(detection):
# determine if is a system type, create risk
elif entity['type'].lower() in risk_object_system_types:
for r in entity['role']:
if 'attacker' == r.lower() or 'victim' ==r.lower():
risk_object['risk_object_type'] = 'system'
risk_object['risk_object_field'] = entity['name']
risk_object['risk_score'] = detection['tags']['risk_score']
@@ -393,12 +393,12 @@ def add_rba(detection):
continue
detection['risk'] = risk_objects
return detection
def add_playbook(detection, playbooks):
preface = " The following Splunk SOAR playbook can be used to respond to this detection: "
for playbook in playbooks:
if detection['name'] in playbook['tags']['detections']:
detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
@@ -456,7 +456,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
if key in detection['tags']:
mappings[key] = detection['tags'][key]
detection['mappings'] = mappings
detection = add_annotations(detection)
detection = add_rba(detection)
detection = add_playbook(detection, playbooks)
@@ -698,7 +698,7 @@ if __name__ == "__main__":
parser.add_argument("-v", "--verbose", required=False, default=False, action='store_true', help="prints verbose output")
parser.add_argument("--product", required=True, default="ESCU", help="package type")
# parse them
args = parser.parse_args()
REPO_PATH = args.path
@@ -706,4 +706,4 @@ if __name__ == "__main__":
VERBOSE = args.verbose
PRODUCT = args.product
main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
bin/jinja2_templates/doc_detection_page_markdown.j2 → bin/jinja2_templates/doc_detection_page.j2
View File
bin/jinja2_templates/doc_detections_markdown.j2 → bin/jinja2_templates/doc_detections.j2
+20 -14
View File
@@ -12,9 +12,7 @@ last_modified_at: {{detection.date}}
toc: true
toc_label: ""
tags:
- {{ detection.type }}
{%- for attack in detection.mitre_attacks %}
- {{ attack.technique_id }}
- {{ attack.technique }}
{%- for attack_tactic in attack.tactic %}
- {{ attack_tactic }}
@@ -23,11 +21,11 @@ tags:
{%- for product in detection.tags.product %}
- {{ product }}
{%- endfor -%}
{%- for cve in detection.cve %}
- {{ cve.id }}
{%- endfor -%}
{%- for datamodel in detection.datamodel %}
- {{ datamodel }}
{%- endfor -%}
{%- for phase in detection.tags.kill_chain_phases %}
- {{ phase }}
{%- endfor %}
---
@@ -50,20 +48,20 @@ We have not been able to test, simulate or build datasets for it, use at your ow
- **ID**: {{ detection.id }}
{% if detection.mitre_attacks %}
#### ATT&CK
#### [ATT&CK](https://attack.mitre.org/)
| ID | Technique | Tactic |
| ----------- | ----------- | -------------- |
{% for attack in detection.mitre_attacks -%}
| ----------- | ----------- |--------------- |
{%- for attack in detection.mitre_attacks %}
{% if attack.technique_id -%}
{%- set sub_technique = attack.technique_id.split('.') -%}{%- if sub_technique | length > 1 -%}
{% set sub_technique = attack.technique_id.split('.') %}{% if sub_technique | length > 1 -%}
| [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{sub_technique[0]}}/{{sub_technique[1]}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
{%- else -%}
{% else -%}
| [{{ attack.technique_id }}](https://attack.mitre.org/techniques/{{attack.technique_id}}/) | {{ attack.technique }} | {{ attack.tactic|join(', ') }} |
{% endif -%}
{%- endif -%}
{%- endfor %}
{% endif %}
{% endif -%}
{% endfor %}
{% endif -%}
#### Search
@@ -92,14 +90,22 @@ We have not been able to test, simulate or build datasets for it, use at your ow
#### Known False Positives
{{ detection.known_false_positives}}
{% if detection.tags.observable %}
#### RBA
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
| {{(detection.tags.impact * detection.tags.confidence)/100}} | {{ detection.tags.impact }} | {{ detection.tags.confidence }} | {{detection.tags.message}} |
{% endif %}
{% if detection.cve %}
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
{% for cve in detection.cve -%}
| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
{% endfor %}
{% endif %}
#### Reference
bin/jinja2_templates/doc_detections_wiki.j2
-98
View File
@@ -1,98 +0,0 @@
=Splunk Security Content Detections =
----
All the detections shipped to different Splunk products. Below is a breakdown by kind.
{% for kind in kinds %}
=={{ kind.name|capitalize }}==
{% for detection in kind.detections %}
==={{ detection.name|capitalize}}===
{{ detection.description }}
* '''Product''': {{ detection.tags.product|join(', ') }}
* '''Datamodel''': {{ detection.datamodel|join(', ') }}
* '''ATT&CK''': {% for attack in detection.mitre_attacks -%}
{%- if attack.technique_id -%}
{% set sub_technique = attack.technique_id.split('.') %}
{%- if sub_technique | length > 1 -%}
[https://attack.mitre.org/techniques/{{sub_technique[0] }}/{{sub_technique[1]}}/ {{ attack.technique_id }}]
{%- else -%}
[https://attack.mitre.org/techniques/{{attack.technique_id}}/ {{ attack.technique_id }}]
{%- endif -%}
{%- endif -%}
{% if not loop.last -%}, {% endif -%}
{% endfor %}
* '''Last Updated''': {{ detection.date }}
<div class="toccolours mw-collapsible mw-collapsed">
<div class="mw-collapsible-content">
====Search====
<search>{{ detection.search|replace("|", "\n|") }}</search>
====Associated Analytic Story====
{% for story in detection.tags.analytic_story %}
* [[Documentation:ESSOC:stories:UseCase#{{ story|replace(" ", "_") }}|{{ story }}]]
{% endfor %}
====How To Implement====
{{ detection.how_to_implement}}
====Required field====
{% for field in detection.tags.required_fields %}
* {{ field }}
{% endfor %}
{% if detection.mitre_attacks|length > 0 %}
====ATT&CK====
{|
! style="text-align:left;"| ID
! Technique
! Tactic
{%-for attack in detection.mitre_attacks %}
|-
| {{ attack.technique_id }}
| {{ attack.technique }}
| {{ attack.tactic|join(', ') }}
{%- endfor %}
|}
{% endif %}
====Kill Chain Phase====
{% for phase in detection.tags.kill_chain_phases %}
* {{ phase }}
{% endfor %}
====Known False Positives====
{{ detection.known_false_positives}}
====Reference====
{% if detection.references %}
{% for reference in detection.references %}
* {{ reference }}
{% endfor %}
{% endif %}
====Test Dataset====
{% for dataset in detection.tags.dataset %}
* {{ dataset }}
{% endfor %}
''version'': {{detection.version}}
</div>
</div>
----
{% endfor %}
{% endfor %}
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
# On Date: {{ time }} UTC''
# Author: Splunk Security Research''
# Contact: research@splunk.com''
#############
</pre>
bin/jinja2_templates/doc_index_markdown.j2 → bin/jinja2_templates/doc_index.j2
View File
bin/jinja2_templates/doc_navigation_markdown.j2 → bin/jinja2_templates/doc_navigation.j2
View File
bin/jinja2_templates/doc_navigation_pages_markdown.j2 → bin/jinja2_templates/doc_navigation_pages.j2
View File
bin/jinja2_templates/doc_navigation_story_pages_markdown.j2 → bin/jinja2_templates/doc_navigation_story_pages.j2
View File
bin/jinja2_templates/doc_playbooks_markdown.j2 → bin/jinja2_templates/doc_playbooks.j2
View File
bin/jinja2_templates/doc_playbooks_page_markdown.j2 → bin/jinja2_templates/doc_playbooks_page.j2
+4
View File
@@ -11,5 +11,9 @@ sidebar:
| Name | Detections | Type |
| --------| ---------- | ----------- |
{% for playbook in playbooks -%}
{% if playbook.tags.detections -%}
| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} |
{% else -%}
| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)| None | {{ playbook.type }} |
{% endif -%}
{%- endfor -%}
bin/jinja2_templates/doc_stories_markdown.j2 → bin/jinja2_templates/doc_stories.j2
View File
bin/jinja2_templates/doc_stories_wiki.j2
-75
View File
@@ -1,75 +0,0 @@
=Splunk Security Content Analytic Story =
----
All the Analytic Stories shipped to different Splunk products. Below is a breakdown by Category.
{% for category in categories %}
=={{ category.name }}==
{% for story in category.stories %}
==={{ story.name|capitalize }}===
{{ story.description }}
* '''Product''': {{ story.tags.product|join(', ') }}
* '''Datamodel''': {%-for datamodel in story.data_models %}[https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}} {{ datamodel }}]{% if not loop.last %}, {% endif %}{%-endfor %}
* '''Last Updated''': {{ story.date }}
* '''Use Case''': {{ story.tags.usecase }}
<div class="toccolours mw-collapsible">
<div class="mw-collapsible-content">
====Detection Profile====
{|
! style="text-align:left;"| name
! ID
! Technique
! Tactic
! Type
{%- for detection in story.detections %}
|-
| [[Documentation:ESSOC:detections:Detections#{{ detection.name|replace(" ", "_")|capitalize }}|{{ detection.name }}]]
{% if story.mitre_attacks|length > 0 %}
| {%-for attack in detection.mitre_attacks %}
[https://attack.mitre.org/techniques/{{ attack.technique_id }}/ {{ attack.technique_id }}]{% if not loop.last %}, {% endif %}
{%-endfor %}
| {%-for attack in detection.mitre_attacks %}
{{ attack.technique}}{{ ", " if not loop.last else "" }}
{%- endfor %}
| {%-for attack in detection.mitre_attacks %}
{{ attack.tactic|join(', ') }}{{ ", " if not loop.last else "" }}
{%- endfor %}
{% else %}
|
|
|
{% endif %}
| {{ detection.type }}
{%- endfor %}
|}
====Kill Chain Phase====
{% for phase in story.kill_chain_phases %}
* {{ phase }}
{% endfor %}
====Reference====
{% for reference in story.references %}
* {{ reference }}
{% endfor %}
''version'': {{story.version}}
</div>
</div>
----
{% endfor %}
{% endfor %}
<pre>
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
# On Date: {{ time }} UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
</pre>
bin/jinja2_templates/doc_story_page_markdown.j2 → bin/jinja2_templates/doc_story_page.j2
View File
bin/yaml_to_json.py
+3 -5
View File
@@ -4,7 +4,7 @@ import csv
from io import StringIO
import re
import os
import shutil
class Yaml2Json():
@@ -274,12 +274,10 @@ class Yaml2Json():
if __name__ == "__main__":
json_types = []
yml_types = ['detections', 'baselines', 'lookups', 'macros', 'response_tasks', 'responses', 'stories', 'deployments']
output_dir = os.path.splitext(__file__)[0]
output_dir = os.path.splitext(os.path.basename(__file__))[0]
shutil.rmtree(output_dir, ignore_errors=True)
os.mkdir(output_dir)
for yt in yml_types:
processor = Yaml2Json(yt)
with open(os.path.join(output_dir, yt + '.json'), 'w') as json_out:
json.dump(processor.list_objects(yt), json_out)
#y = Yaml2Json('macros')
#print(y.list_objects('macros'))
detections/cloud/gsuite_drive_share_in_external_email.yml
+3 -2
View File
@@ -19,7 +19,9 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
| `gsuite_drive_share_in_external_email_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: network admin or normal user may share files to customer and
external team.
references:
@@ -67,4 +69,3 @@ tags:
- parameters.doc_type
risk_score: 72
security_domain: endpoint
detections/cloud/gsuite_suspicious_shared_file_name.yml
+3 -1
View File
@@ -24,7 +24,9 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
| `gsuite_suspicious_shared_file_name_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to gsuite having the file attachment metadata like file type, file
extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
extension, source email, destination email, num of attachment and etc. In order
for the search to work for your environment, please edit the query to use your company
specific email domain instead of `internal_test_email.com`.
known_false_positives: normal user or normal transaction may contain the subject and
file type attachment that this detection try to search
references:
detections/deprecated/open_redirect_in_splunk_web.yml
+2
View File
@@ -19,6 +19,8 @@ tags:
- CIS 3
- CIS 4
- CIS 18
cve:
- CVE-2016-4859
kill_chain_phases:
- Delivery
nist:
detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml
+2
View File
@@ -24,6 +24,8 @@ tags:
asset_type: Endpoint
cis20:
- CIS 4
cve:
- CVE-2017-5753
nist:
- ID.RA
- RS.MI
detections/deprecated/splunk_enterprise_information_disclosure.yml
+2
View File
@@ -26,6 +26,8 @@ tags:
- CIS 3
- CIS 4
- CIS 18
cve:
- CVE-2018-11409
kill_chain_phases:
- Delivery
nist:
detections/endpoint/active_setup_registry_autostart.yml
+17 -17
View File
@@ -33,13 +33,29 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1547.014/active_setup_stubpath/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1547.014
- T1547
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -51,21 +67,5 @@ tags:
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 80
risk_score: 64
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/change_default_file_association.yml
+17 -17
View File
@@ -30,13 +30,29 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 100
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1546.001
- T1546
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -48,21 +64,5 @@ tags:
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/control_loading_from_world_writable_directory.yml
+2
View File
@@ -39,6 +39,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
impact: 80
detections/endpoint/detect_computer_changed_with_anonymous_account.yml
+2
View File
@@ -30,6 +30,8 @@ tags:
context:
- Source:Endpoint
- Stage:Lateral Movement
cve:
- CVE-2020-1472
impact: 70
kill_chain_phases:
- Actions on Objectives
detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+2
View File
@@ -40,6 +40,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-36934
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-powershell.log
impact: 80
detections/endpoint/disable_security_logs_using_minint_registry.yml
+20 -20
View File
@@ -15,9 +15,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim
by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name
Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `disable_security_logs_using_minint_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting
data that records registry activity from your hosts to populate the endpoint data
model in the registry node. This is typically populated via endpoint detection-and-response
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
@@ -27,12 +27,28 @@ references:
tags:
analytic_story:
- Windows Defense Evasion Tactics
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/minint_reg/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1112
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -45,21 +61,5 @@ tags:
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/disable_uac_remote_restriction.yml
+17 -17
View File
@@ -31,13 +31,29 @@ tags:
analytic_story:
- Windows Defense Evasion Tactics
- Suspicious Windows Registry Activities
automated_detection_testing: passed
confidence: 100
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/LocalAccountTokenFilterPolicy/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1548.002
- T1548
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -50,21 +66,5 @@ tags:
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_value_data
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+20 -20
View File
@@ -17,9 +17,9 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTim
= 0x00000001 by Registry.dest Registry.user Registry.registry_value_name Registry.registry_key_name
Registry.registry_path Registry.registry_value_data | `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)` | `enable_wdigest_uselogoncredential_registry_filter`'
how_to_implement: To successfully implement this search, you must be ingesting
data that records registry activity from your hosts to populate the endpoint data
model in the registry node. This is typically populated via endpoint detection-and-response
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
in the registry node. This is typically populated via endpoint detection-and-response
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
@@ -29,13 +29,29 @@ references:
tags:
analytic_story:
- Credential Dumping
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/wdigest_enable/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: wdigest registry $registry_path$ was modified in $dest$
mitre_attack_id:
- T1112
- T1003
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -48,21 +64,5 @@ tags:
- Registry.registry_key_name
- Registry.registry_path
- Registry.registry_value_data
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Credential Access
message: wdigest registry $registry_path$ was modified in $dest$
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/etw_registry_disabled.yml
+17 -17
View File
@@ -28,14 +28,30 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 100
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/etw_disable/sysmon.log
impact: 90
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1562.006
- T1127
- T1562
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -48,21 +64,5 @@ tags:
- Registry.registry_key_name
- Registry.registry_value_name
- Registry.registry_value_data
security_domain: endpoint
impact: 90
confidence: 100
risk_score: 90
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/logon_script_event_trigger_execution.yml
+17 -17
View File
@@ -28,13 +28,29 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 100
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1037.001/logonscript_reg/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1037
- T1037.001
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -46,21 +62,5 @@ tags:
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/malicious_inprocserver32_modification.yml
+18 -18
View File
@@ -46,13 +46,30 @@ tags:
analytic_story:
- Suspicious Regsvr32 Activity
- Remcos
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: The $process_name$ was identified on endpoint $dest$ modifying the registry
with a known malicious clsid under InProcServer32.
mitre_attack_id:
- T1218.010
- T1112
observable:
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -65,22 +82,5 @@ tags:
- registry_key_name
- registry_value_name
- user
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
message: The $process_name$ was identified on endpoint $dest$ modifying the registry
with a known malicious clsid under InProcServer32.
observable:
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml
+22 -18
View File
@@ -5,18 +5,22 @@ date: '2021-10-05'
author: David Dorsey, Michael Haag Splunk
type: Hunting
datamodel:
- Endpoint
description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet.
Removed in this version of the query is New-Object.
The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]")
| `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`'
- Endpoint
description: The following hunting analytic identifies PowerShell commands utilizing
the WindowStyle parameter to hide the window on the compromised endpoint. This combination
of command-line options is suspicious because it is overriding the default PowerShell
execution policy, attempts to hide its activity from the user, and connects to the
Internet. Removed in this version of the query is New-Object. The analytic identifies
all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter.
For example w, win, windowsty and so forth. In addition, through our research it
was identified that PowerShell will interpret different command switch types beyond
the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
\ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
\ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
\ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
\ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
|\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`"
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -24,11 +28,11 @@ how_to_implement: You must be ingesting data that records process activity from
model.
known_false_positives: Legitimate process can have this combination of command-line
options, but it's not common.
references:
- https://regexr.com/663rr
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
references:
- https://regexr.com/663rr
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
tags:
analytic_story:
- Malicious PowerShell
@@ -86,4 +90,4 @@ tags:
- Processes.parent_process_name
- Processes.dest
risk_score: 81
security_domain: endpoint
security_domain: endpoint
detections/endpoint/malicious_powershell_process___encoded_command.yml
+30 -21
View File
@@ -5,29 +5,38 @@ date: '2021-10-05'
author: David Dorsey, Michael Haag, Splunk
type: Hunting
datamodel:
- Endpoint
description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \
The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \
During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \
- Endpoint
description: 'The following analytic identifies the use of the EncodedCommand PowerShell
parameter. This is typically used by Administrators to run complex scripts, but
commonly used by adversaries to hide their code. \
The analytic identifies all variations of EncodedCommand, as PowerShell allows the
ability to shorten the parameter. For example enc, enco, encod and so forth. In
addition, through our research it was identified that PowerShell will interpret
different command switch types beyond the hyphen. We have added endash, emdash,
horizontal bar, and forward slash. \
During triage, review parallel events to determine legitimacy. Tune as needed based
on admin scripts in use. \
Alternatively, may use regex per matching here https://regexr.com/662ov.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user
Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]")
| `malicious_powershell_process___encoded_command_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
\ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
\ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
\ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
\ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
|\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: System administrators may use this option, but it's not common.
references:
- https://regexr.com/662ov
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
- https://regexr.com/662ov
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
- https://ss64.com/ps/powershell.html
- https://twitter.com/M_haggis/status/1440758396534214658?s=20
tags:
analytic_story:
- Malicious PowerShell
@@ -75,4 +84,4 @@ tags:
- Processes.dest
- Processes.process_id
risk_score: 35
security_domain: endpoint
security_domain: endpoint
detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
+31 -26
View File
@@ -6,12 +6,12 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to detect a suspicious child process of MSBuild
spawned by Windows Script Host - cscript or wscript.
This behavior or event are commonly seen and used by malware or adversaries
to execute malicious msbuild process using malicious script in the compromised host.
During triage, review parallel processes and identify any file modifications. MSBuild
may load a script from the same path without having command-line arguments.
description: This analytic is to detect a suspicious child process of MSBuild spawned
by Windows Script Host - cscript or wscript. This behavior or event are commonly
seen and used by malware or adversaries to execute malicious msbuild process using
malicious script in the compromised host. During triage, review parallel processes
and identify any file modifications. MSBuild may load a script from the same path
without having command-line arguments.
search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
@@ -19,20 +19,42 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives should be limited as developers do not spawn MSBuild via a WSH.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives should be limited as developers do not spawn
MSBuild via a WSH.
references:
- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
tags:
analytic_story:
- Trusted Developer Utilities Proxy Execution MSBuild
automated_detection_testing: passed
confidence: 70
context:
- Stage:Execution
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/regsvr32_silent/sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed
by $user$
mitre_attack_id:
- T1127.001
- T1127
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: User
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -45,22 +67,5 @@ tags:
- Processes.process_name
- Processes.original_file_name
- Processes.user
security_domain: endpoint
impact: 70
confidence: 70
risk_score: 49
context:
- Stage:Execution
- Stage:Defense Evasion
message: Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed
by $user$
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: User
type: User
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/mshtml_module_load_in_office_product.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log
impact: 80
detections/endpoint/office_product_writing_cab_or_inf.yml
+2
View File
@@ -41,6 +41,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log
impact: 80
detections/endpoint/office_spawning_control.yml
+2
View File
@@ -42,6 +42,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log
impact: 80
detections/endpoint/petitpotam_network_share_access_request.yml
+2
View File
@@ -39,6 +39,8 @@ tags:
context:
- Source:Endpoint
- Stage:Credential Access
cve:
- CVE-2021-36942
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log
impact: 80
detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
+2
View File
@@ -33,6 +33,8 @@ tags:
context:
- Source:Endpoint
- Stage:Credential Access
cve:
- CVE-2021-36942
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log
impact: 80
detections/endpoint/print_spooler_adding_a_printer_driver.yml
+3
View File
@@ -42,6 +42,9 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Incoming
cve:
- CVE-2021-34527
- CVE-2021-1675
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log
impact: 80
detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+3
View File
@@ -40,6 +40,9 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Incoming
cve:
- CVE-2021-34527
- CVE-2021-1675
dataset: []
impact: 80
kill_chain_phases:
detections/endpoint/process_writing_dynamicwrapperx.yml
+25 -24
View File
@@ -32,7 +32,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
latest TA for the endpoint product.
known_false_positives: False positives should be limited, however it is possible to
filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
as needed. This may need modification based on EDR telemetry and how it brings in
registry data. For example, removal of (Default).
references:
- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
- https://www.script-coding.com/dynwrapx_eng.html
@@ -42,34 +43,21 @@ references:
tags:
analytic_story:
- Remcos
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059
- T1559.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- dest
- process_name
- process_guid
- file_name
- file_path
- file_create_time user
security_domain: endpoint
impact: 80
automated_detection_testing: passed
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $process_name$ was identified on endpoint $dest$ downloading
the DynamicWrapperX dll.
mitre_attack_id:
- T1059
- T1559.001
observable:
- name: user
type: User
@@ -83,4 +71,17 @@ tags:
type: Process
role:
- Child Process
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- dest
- process_name
- process_guid
- file_name
- file_path
- file_create_time user
risk_score: 80
security_domain: endpoint
detections/endpoint/registry_keys_used_for_persistence.yml
+7 -8
View File
@@ -11,14 +11,13 @@ description: The search looks for modifications to registry keys that can be use
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
as registry_key_name values(Registry.registry_path) as registry_path min(_time)
as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path=*\\currentversion\\run*
OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet*
OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run* OR Registry.registry_path=*\\currentversion\\runservices*
OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\* OR (Registry.registry_path="*Microsoft\\Windows
NT\\CurrentVersion\\Image File Execution Options*" AND Registry.registry_key_name=Debugger)
OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa" AND Registry.registry_key_name="Security
Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Shell*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Notify* OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\Userinit*
OR Registry.registry_path=*\\CurrentVersion\\Winlogon\\VmApplet* OR Registry.registry_path=*\\currentversion\\policies\\explorer\\run*
OR Registry.registry_path=*\\currentversion\\runservices* OR Registry.registry_path=HKLM\\SOFTWARE\\Microsoft\\Netsh\\*
OR (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File Execution
Options*" AND Registry.registry_key_name=Debugger) OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa"
AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\CurrentControlSet\\Control\\Lsa\\OSConfig"
AND Registry.registry_key_name="Security Packages") OR (Registry.registry_path="*\\Microsoft\\Windows
NT\\CurrentVersion\\SilentProcessExit\\*") OR (Registry.registry_path="*currentVersion\\Windows"
AND Registry.registry_key_name="Load") OR (Registry.registry_path="*\\CurrentVersion"
detections/endpoint/regsvr32_silent_param_dll_loading.yml
+17 -17
View File
@@ -30,13 +30,29 @@ references:
tags:
analytic_story:
- Suspicious Regsvr32 Activity
automated_detection_testing: passed
confidence: 60
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
impact: 60
kill_chain_phases:
- Exploitation
message: regsvr32 process with $process$ commandline in $dest$
mitre_attack_id:
- T1218
- T1218.010
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -54,21 +70,5 @@ tags:
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 60
confidence: 60
risk_score: 36
context:
- Source:Endpoint
- Stage:Defense Evasion
message: regsvr32 process with $process$ commandline in $dest$
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/remcos_client_registry_install_entry.yml
+13 -13
View File
@@ -23,12 +23,24 @@ references:
tags:
analytic_story:
- Remcos
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log
impact: 90
kill_chain_phases:
- Exploitation
message: A registry entry $registry_path$ with registry keyname $registry_key_name$
related to Remcos RAT in host $dest$
mitre_attack_id:
- T1112
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -40,17 +52,5 @@ tags:
- Registry.process_id
- Registry.dest
- Registry.user
security_domain: endpoint
impact: 90
confidence: 100
risk_score: 90
context:
- Source:Endpoint
message: A registry entry $registry_path$ with registry keyname $registry_key_name$
related to Remcos RAT in host $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/rundll32_control_rundll_hunt.yml
+2
View File
@@ -42,6 +42,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
impact: 30
detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+2
View File
@@ -44,6 +44,8 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
cve:
- CVE-2021-40444
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.002/atomic_red_team/windows-sysmon.log
impact: 80
detections/endpoint/rundll32_shimcache_flush.yml
+35 -31
View File
@@ -14,47 +14,33 @@ description: This analytic is to detect a suspicious rundll32 commandline to cle
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_rundll32` AND Processes.process
= "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `rundll32_shimcache_flush_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
tags:
analytic_story:
- Unusual Processes
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1112
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 80
automated_detection_testing: passed
confidence: 100
risk_score: 80
context:
- Stage:Execution
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/shimcache_flush/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: rundll32 process execute $process$ to clear shim cache in $dest$
mitre_attack_id:
- T1112
observable:
- name: dest
type: Endpoint
@@ -64,4 +50,22 @@ tags:
type: User
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+2
View File
@@ -46,6 +46,8 @@ tags:
context:
- source:endpoint
- stage: Defense Evasion
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
impact: 70
detections/endpoint/sam_database_file_access_attempt.yml
+2
View File
@@ -35,6 +35,8 @@ tags:
context:
- Source:Endpoint
- Stage:Credential Access
cve:
- CVE-2021-36934
impact: 80
kill_chain_phases:
- Exploitation
detections/endpoint/screensaver_event_trigger_execution.yml
+17 -17
View File
@@ -31,13 +31,29 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 90
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.002/scrnsave_reg/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1546
- T1546.002
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -49,21 +65,5 @@ tags:
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 90
risk_score: 72
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/sdelete_application_execution.yml
+31 -27
View File
@@ -19,46 +19,32 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `sdelete_application_execution_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: user may execute and use this application
references:
- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
tags:
analytic_story:
- Masquerading - Rename System Utilities
automated_detection_testing: passed
confidence: 70
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: sdelete process $process_name$ executed in $dest$
mitre_attack_id:
- T1485
- T1070.004
- T1070
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 70
confidence: 70
risk_score: 49
context:
- Source:Endpoint
- Stage:Execution
message: sdelete process $process_name$ executed in $dest$
observable:
- name: dest
type: Endpoint
@@ -68,4 +54,22 @@ tags:
type: User
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+102
View File
@@ -0,0 +1,102 @@
name: ServicePrincipalNames Discovery with PowerShell
id: 13243068-2d38-11ec-8908-acde48001122
version: 1
date: '2021-10-14'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: 'The following analytic identifies `powershell.exe` usage, using Script
Block Logging EventCode 4104, related to querying the domain for Service Principle
Names. typically, this is a precursor activity related to kerberoasting or the silver
ticket attack. \
What is a ServicePrincipleName? \
A service principal name (SPN) is a unique identifier of a service instance. SPNs
are used by Kerberos authentication to associate a service instance with a service
logon account. This allows a client application to request that the service authenticate
an account even if the client does not have the account name.\
The following analytic identifies the use of KerberosRequestorSecurityToken class
within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken
class in PowerShell is the equivelant of using setspn.exe. \
During triage, review parallel processes for further suspicious activity.'
search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" |
stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName
User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `serviceprincipalnames_discovery_with_powershell_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives should be limited, however filter as needed.
references:
- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
- https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html
- https://attack.mitre.org/techniques/T1558/003/
- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx
- https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
- https://blog.zsec.uk/paving-2-da-wholeset/
- https://msitpros.com/?p=3113
- https://adsecurity.org/?p=3466
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
analytic_story:
- Active Directory Discovery
- Lateral Movement
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log
impact: 80
kill_chain_phases:
- Lateral Movement
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to identify service principle names.
mitre_attack_id:
- T1558.003
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+109
View File
@@ -0,0 +1,109 @@
name: ServicePrincipalNames Discovery with SetSPN
id: ae8b3efc-2d2e-11ec-8b57-acde48001122
version: 1
date: '2021-10-14'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: 'The following analytic identifies `setspn.exe` usage related to querying
the domain for Service Principle Names. typically, this is a precursor activity
related to kerberoasting or the silver ticket attack. \
What is a ServicePrincipleName? \
A service principal name (SPN) is a unique identifier of a service instance. SPNs
are used by Kerberos authentication to associate a service instance with a service
logon account. This allows a client application to request that the service authenticate
an account even if the client does not have the account name.\
Example usage includes the following \
1. setspn -T offense -Q */* 1. setspn -T attackrange.local -F -Q MSSQLSvc/* 1. setspn
-Q */* > allspns.txt 1. setspn -q \
Values \
1. -F = perform queries at the forest, rather than domain level 1. -T = perform
query on the specified domain or forest (when -F is also used) 1. -Q = query for
existence of SPN \
During triage, review parallel processes for further suspicious activity.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_setspn` (Processes.process="*-t*"
AND Processes.process="*-f*") OR (Processes.process="*-q*" AND Processes.process="**/**")
OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.dest Processes.user
Processes.parent_process_name Processes.process_name Processes.original_file_name
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: False positives may be caused by Administrators resetting SPNs
or querying for SPNs. Filter as needed.
references:
- https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
- https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html
- https://attack.mitre.org/techniques/T1558/003/
- https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx
- https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
- https://blog.zsec.uk/paving-2-da-wholeset/
- https://msitpros.com/?p=3113
- https://adsecurity.org/?p=3466
tags:
analytic_story:
- Active Directory Discovery
- Lateral Movement
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log
impact: 80
kill_chain_phases:
- Lateral Movement
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to identify service principle names.
mitre_attack_id:
- T1558.003
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
detections/endpoint/spoolsv_spawning_rundll32.yml
+2
View File
@@ -39,6 +39,8 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Local
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
detections/endpoint/spoolsv_suspicious_loaded_modules.yml
+2
View File
@@ -30,6 +30,8 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Local
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
detections/endpoint/spoolsv_suspicious_process_access.yml
+2
View File
@@ -36,6 +36,8 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Local
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
detections/endpoint/spoolsv_writing_a_dll.yml
+2
View File
@@ -40,6 +40,8 @@ tags:
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Defense Evasion
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
+2
View File
@@ -36,6 +36,8 @@ tags:
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Local
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
impact: 80
detections/endpoint/ssa___attempt_to_delete_services.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Attempt To delete Services
id: a0c8c292-d01a-11eb-aa18-acde48001122
version: 1
version: 2
date: '2021-06-18'
author: Teoderick Contreras, splunk
type: TTP
@@ -33,12 +33,18 @@ tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 8
- CIS 13
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
@@ -49,4 +55,5 @@ tags:
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___attempt_to_disable_services.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Attempt To Disable Services
id: afb31de4-d023-11eb-98d5-acde48001122
version: 1
version: 2
date: '2021-06-18'
author: Teoderick Contreras, Splunk
type: TTP
@@ -35,12 +35,18 @@ tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 9
- CIS 8
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
@@ -51,4 +57,5 @@ tags:
- process_path
- dest_user_id
- process
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___delete_a_net_user.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Delete A Net User
id: 8776d79c-d26e-11eb-9a56-acde48001122
version: 1
version: 2
date: '2021-06-21'
author: Teoderick Contreras, Splunk
type: Anomaly
@@ -36,12 +36,18 @@ tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 4
- CIS 16
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.AC
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
@@ -52,4 +58,5 @@ tags:
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 1
version: 2
date: '2021-06-14'
author: Teoderick Contreras, Splunk
type: TTP
@@ -33,6 +33,9 @@ references:
tags:
analytic_story:
- XMRig
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- source:endpoint
@@ -46,6 +49,9 @@ tags:
a permission of a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
type: Hostname
@@ -66,4 +72,5 @@ tags:
- dest_user_id
- process
risk_score: 35
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___disable_net_user_account.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 1
version: 2
date: '2021-06-21'
author: Teoderick Contreras, Splunk
type: TTP
@@ -35,12 +35,18 @@ tags:
analytic_story:
- XMRig
- Ransomware
cis20:
- CIS 4
- CIS 16
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.AC
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
@@ -51,4 +57,5 @@ tags:
- process_path
- dest_user_id
- process
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 1
version: 2
date: '2021-06-14'
author: Teoderick Contreras, Splunk
type: TTP
@@ -33,6 +33,9 @@ references:
tags:
analytic_story:
- XMRig
cis20:
- CIS 14
- CIS 16
confidence: 70
context:
- source:endpoint
@@ -46,6 +49,9 @@ tags:
user a permission to a file or directory in host $dest_device_id$
mitre_attack_id:
- T1222
nist:
- PR.AC
- PR.IP
observable:
- name: dest_device_id
type: Hostname
@@ -66,4 +72,5 @@ tags:
- dest_user_id
- process
risk_score: 35
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Resize Shadowstorage Volume
id: dbc30554-d27e-11eb-9e5e-acde48001122
version: 1
version: 2
date: '2021-06-21'
author: Teoderick Contreras, Splunk
type: TTP
@@ -37,12 +37,18 @@ tags:
analytic_story:
- Clop Ransomware
- Ransomware
cis20:
- CIS 10
- CIS 13
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1489
nist:
- PR.DS
- PR.IP
product:
- Splunk Behavioral Analytics
required_fields:
@@ -53,4 +59,5 @@ tags:
- process_path
- dest_user_id
- process
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: WevtUtil Usage To Clear Logs
id: 5438113c-cdd9-11eb-93b8-acde48001122
version: 1
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
@@ -37,6 +37,9 @@ tags:
- Windows Log Manipulation
- Ransomware
- Clop Ransomware
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- source:endpoint
@@ -51,6 +54,9 @@ tags:
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
type: Hostname
@@ -71,4 +77,5 @@ tags:
- dest_user_id
- process
risk_score: 63
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+8 -1
View File
@@ -1,6 +1,6 @@
name: Wevtutil Usage To Disable Logs
id: a4bdc944-cdd9-11eb-ac97-acde48001122
version: 1
version: 2
date: '2021-06-15'
author: Teoderick Contreras, Splunk
type: TTP
@@ -33,6 +33,9 @@ tags:
analytic_story:
- Windows Log Manipulation
- Ransomware
cis20:
- CIS 8
- CIS 13
confidence: 90
context:
- source:endpoint
@@ -47,6 +50,9 @@ tags:
mitre_attack_id:
- T1070
- T1070.001
nist:
- PR.DS
- PR.IP
observable:
- name: dest_device_id
type: Hostname
@@ -67,4 +73,5 @@ tags:
- dest_user_id
- process
risk_score: 63
risk_severity: high
security_domain: endpoint
detections/endpoint/suspicious_copy_on_system32.yml
+39 -34
View File
@@ -13,50 +13,37 @@ description: This analytic is to detect a suspicious copy of file from systemroo
but this is really a anomaly that needs to be check within the network.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe") AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*",
"*\\Windows\\SysWow64\\*") AND Processes.process = "*copy*" by Processes.dest Processes.user
Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `suspicious_copy_on_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
AND `process_copy` AND Processes.process IN("*\\Windows\\System32\*", "*\\Windows\\SysWow64\\*")
AND Processes.process = "*copy*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
`suspicious_copy_on_system32_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: every user may do this event but very un-ussual.
references:
- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
tags:
analytic_story:
- Unusual Processes
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1036.003
- T1036
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 70
automated_detection_testing: passed
confidence: 90
risk_score: 63
context:
- Stage:Execution
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/copy_sysmon/sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: execution of copy exe to copy file from $process$ in $dest$
mitre_attack_id:
- T1036.003
- T1036
observable:
- name: dest
type: Endpoint
@@ -66,4 +53,22 @@ tags:
type: User
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 63
security_domain: endpoint
detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+2
View File
@@ -44,6 +44,8 @@ tags:
- Stage:Execution
- Stage:Initial Access
- Stage:Defense Evasion
cve:
- CVE-2021-34527
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log
impact: 70
detections/endpoint/suspicious_wevtutil_usage.yml
+8 -8
View File
@@ -7,15 +7,15 @@ type: TTP
datamodel:
- Endpoint
description: The wevtutil.exe application is the windows event log utility. This searches
for wevtutil.exe with parameters for clearing the application, security, setup, trace
or system event logs.
for wevtutil.exe with parameters for clearing the application, security, setup,
trace or system event logs.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*") (Processes.process="*System*"
OR Processes.process="*Security*" OR Processes.process="*Setup*" OR Processes.process="*Application*" OR Processes.process="*trace*")
by Processes.process_name Processes.parent_process_name Processes.dest Processes.user|
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
| `suspicious_wevtutil_usage_filter`'
where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*")
(Processes.process="*System*" OR Processes.process="*Security*" OR Processes.process="*Setup*"
OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name
Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`'
how_to_implement: You must be ingesting data that records process activity from your
hosts to populate the Endpoint data model in the Processes node. You must also be
ingesting logs with both the process name and command line from your endpoints.
@@ -24,7 +24,7 @@ how_to_implement: You must be ingesting data that records process activity from
known_false_positives: The wevtutil.exe application is a legitimate Windows event
log utility. Administrators may use it to manage Windows event logs.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
tags:
analytic_story:
- Windows Log Manipulation
detections/endpoint/time_provider_persistence_registry.yml
+17 -17
View File
@@ -31,13 +31,29 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
automated_detection_testing: passed
confidence: 100
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.003/timeprovider_reg/sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1547.003
- T1547
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -49,21 +65,5 @@ tags:
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 100
risk_score: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
observable:
- name: dest
type: Hostname
role:
- Victim
- name: user
type: user
role:
- Victim
automated_detection_testing: passed
security_domain: endpoint
detections/endpoint/unified_messaging_service_spawning_a_process.yml
+2
View File
@@ -41,6 +41,8 @@ tags:
- Source:Endpoint
- Stage:Initial Access
- Stage:Execution
cve:
- CVE-2021-26857
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_umservices.log
impact: 70
detections/endpoint/vbscript_execution_using_wscript_app.yml
+33 -29
View File
@@ -18,7 +18,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
Processes.parent_process Processes.process_name Processes.process_id Processes.process
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://www.joesandbox.com/analysis/369332/0/html
@@ -26,38 +30,20 @@ tags:
analytic_story:
- FIN7
- Remcos
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1059.005
- T1059
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 70
automated_detection_testing: passed
confidence: 70
risk_score: 49
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: Process name $process_name$ with commandline $process$ to execute vbsscript
mitre_attack_id:
- T1059.005
- T1059
observable:
- name: dest
type: Endpoint
@@ -67,4 +53,22 @@ tags:
type: User
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
detections/endpoint/verclsid_clsid_execution.yml
+33 -29
View File
@@ -19,7 +19,11 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `verclsid_clsid_execution_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: windows can used this application for its normal COM object
validation.
references:
@@ -28,39 +32,21 @@ references:
tags:
analytic_story:
- Unusual Processes
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1218.012
- T1218
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 50
automated_detection_testing: passed
confidence: 50
risk_score: 25
context:
- source:endpoint
- stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.012/verclsid_exec/sysmon.log
impact: 50
kill_chain_phases:
- Exploitation
message: process $process_name$ to execute possible clsid commandline $process$
in $dest$
mitre_attack_id:
- T1218.012
- T1218
observable:
- name: dest
type: Hostname
@@ -70,4 +56,22 @@ tags:
type: user
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 25
security_domain: endpoint
detections/endpoint/w3wp_spawning_shell.yml
+4
View File
@@ -43,6 +43,10 @@ tags:
- Source:Endpoint
- Stage:Initial Access
- Stage:Execution
cve:
- CVE-2021-34473
- CVE-2021-34523
- CVE-2021-31207
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon.log
impact: 70
detections/endpoint/winhlp32_spawning_a_process.yml
+27 -27
View File
@@ -36,38 +36,20 @@ references:
tags:
analytic_story:
- Remcos
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1055
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 80
automated_detection_testing: passed
confidence: 100
risk_score: 80
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$, and is not typical activity for this process.
mitre_attack_id:
- T1055
observable:
- name: user
type: User
@@ -85,4 +67,22 @@ tags:
type: Process
role:
- Child Process
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+26 -26
View File
@@ -33,40 +33,22 @@ tags:
- FIN7
- Remcos
- Unusual Processes
automated_detection_testing: passed
confidence: 70
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.005/vbs_wscript/sysmon.log
impact: 70
kill_chain_phases:
- Exploitation
message: wscript or cscript parent process spawned $process_name$ in $dest$
mitre_attack_id:
- T1055
- T1543
- T1134.004
- T1134
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
security_domain: endpoint
impact: 70
confidence: 70
risk_score: 49
context:
- Source:Endpoint
- Stage:Execution
message: wscript or cscript parent process spawned $process_name$ in $dest$
observable:
- name: dest
type: Endpoint
@@ -76,4 +58,22 @@ tags:
type: User
role:
- Victim
automated_detection_testing: passed
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml
+2
View File
@@ -32,6 +32,8 @@ tags:
cis20:
- CIS 5
- CIS 8
cve:
- CVE-2018-8440
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml
+2
View File
@@ -22,6 +22,8 @@ tags:
- CIS 8
- CIS 12
- CIS 16
cve:
- CVE-2021-3156
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
+2
View File
@@ -25,6 +25,8 @@ tags:
- CIS 8
- CIS 12
- CIS 16
cve:
- CVE-2021-3156
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
+2
View File
@@ -22,6 +22,8 @@ tags:
- CIS 8
- CIS 12
- CIS 16
cve:
- CVE-2021-3156
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/endpoint/print_processor_registry_autostart.yml
+32 -33
View File
@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: This analytic is to detect a suspicious modification or new registry entry regarding print processor.
This registry is known to be abuse by turla or other APT to gain persistence and privilege escalation to the compromised machine.
This is done by adding the malicious dll payload on the new created key in this registry that will be executed as it restarted the spoolsv.exe process and services.
description: This analytic is to detect a suspicious modification or new registry
entry regarding print processor. This registry is known to be abuse by turla or
other APT to gain persistence and privilege escalation to the compromised machine.
This is done by adding the malicious dll payload on the new created key in this
registry that will be executed as it restarted the spoolsv.exe process and services.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
max(_time) as lastTime FROM datamodel=Endpoint.Registry
where Registry.registry_path ="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*"
by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)`
max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
="*\\Control\\Print\\Environments\\Windows x64\\Print Processors*" by Registry.dest Registry.user
Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
`security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
| `print_processor_registry_autostart_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
that records registry activity from your hosts to populate the endpoint data model
@@ -23,7 +23,8 @@ how_to_implement: To successfully implement this search, you must be ingesting d
product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
used for this search is typically generated via logs that report reads and writes
to the registry.
known_false_positives: possible new printer installation may add driver component on this registry.
known_false_positives: possible new printer installation may add driver component
on this registry.
references:
- https://attack.mitre.org/techniques/T1547/012/
- https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
@@ -31,33 +32,19 @@ tags:
analytic_story:
- Windows Persistence Techniques
- Windows Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1547.012
- T1547
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
security_domain: endpoint
impact: 80
confidence: 100
# (impact * confidence)/100
risk_score: 80
context:
- source:endpoint
- stage:Privilege Escalation Persistence
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log
impact: 80
kill_chain_phases:
- Exploitation
message: modified/added/deleted registry entry $Registry.registry_path$ in $dest$
mitre_attack_id:
- T1547.012
- T1547
observable:
- name: dest
type: Hostname
@@ -67,4 +54,16 @@ tags:
type: user
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Registry.dest
- Registry.user
- Registry.registry_path
- Registry.registry_key_name
- Registry.registry_value_name
risk_score: 80
security_domain: endpoint
detections/experimental/endpoint/winrm_spawning_a_process.yml
+2
View File
@@ -30,6 +30,8 @@ references:
tags:
analytic_story:
- Unusual Processes
cve:
- CVE-2021-31166
dataset: []
kill_chain_phases:
- Exploitation
detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml
+2
View File
@@ -24,6 +24,8 @@ tags:
cis20:
- CIS 8
- CIS 12
cve:
- CVE-2020-1350
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml
+2
View File
@@ -27,6 +27,8 @@ tags:
cis20:
- CIS 8
- CIS 16
cve:
- CVE-2020-1350
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/network/detect_zerologon_via_zeek.yml
+2
View File
@@ -28,6 +28,8 @@ tags:
cis20:
- CIS 8
- CIS 11
cve:
- CVE-2020-1472
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml
+2
View File
@@ -27,6 +27,8 @@ tags:
cis20:
- CIS 8
- CIS 11
cve:
- CVE-2020-5902
kill_chain_phases:
- Exploitation
mitre_attack_id:
detections/network/dns_query_length_with_high_standard_deviation.yml
+4 -4
View File
@@ -11,10 +11,10 @@ description: This search allows you to identify DNS requests and compute the sta
standard deviation to show you those queries that are unusually large for your environment.
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
| eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24
| eval query_length = len(query) | table query query_length record_type count |
eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length)
AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
| eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld)
| search tld_len<=24 | eval query_length = len(query) | table query query_length
record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS
avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
| `dns_query_length_with_high_standard_deviation_filter`'
how_to_implement: To successfully implement this search, you will need to ensure that
DNS data is populating the Network_Resolution data model.
detections/network/investigate_network_traffic_from_src_ip.yml
+2
View File
@@ -17,6 +17,8 @@ tags:
analytic_story:
- ColdRoot MacOS RAT
- Splunk Enterprise Vulnerability CVE-2018-11409
cve:
- CVE-2018-11409
product:
- Splunk Phantom
required_fields:
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.29.0"
"version": "3.30.0"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+929 -675
View File
File diff suppressed because it is too large Load Diff
dist/escu/default/app.conf
Vendored
+3 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 1298
build = 2047
[triggers]
reload.analytic_stories = simple
@@ -16,10 +16,11 @@ reload.governance = simple
reload.managed_configurations = simple
reload.postprocess = simple
reload.content-version = simple
reload.es_investigations = simple
[launcher]
author = Splunk
version = 3.29.0
version = 3.30.0
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-30T19:01:47 UTC
# On Date: 2021-10-28T22:30:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.29.0
version = 3.30.0
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -421,7 +421,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
[panel_group://workbench_panel_group_ransomware]
label = Ransomware
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain'
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. /n**SOAR:** The following Splunk SOAR playbooks can be used in the response to this story's analytics: 'Ransomware Investigate and Contain'
disabled = 0
panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_rundll32_lockworkstation___response_task"]
dist/escu/default/macros.conf
Vendored
+113 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2021-09-30T19:01:48 UTC
# On Date: 2021-10-28T22:30:10 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -274,6 +274,10 @@ description = Matches the process with its original file name, data for this mac
definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_copy]
definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_dllhost]
definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
@@ -362,6 +366,18 @@ description = Matches the process with its original file name, data for this mac
definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_sdelete]
definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_setspn]
definition = (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_verclsid]
definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_vssadmin]
definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
@@ -647,6 +663,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[active_setup_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[add_defaultuser_and_password_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -831,6 +851,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[change_default_file_association_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[change_to_safe_mode_with_network_config_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1439,10 +1463,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_security_logs_using_minint_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_show_hidden_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_uac_remote_restriction_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_windows_app_hotkeys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1571,6 +1603,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[etw_registry_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[elevated_group_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -1599,6 +1635,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[enable_wdigest_uselogoncredential_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[enumerate_users_local_group_using_telegram_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2267,6 +2307,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[logon_script_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ms_scripting_process_loading_ldap_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2275,6 +2319,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[msbuild_suspicious_spawned_by_script_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mshtml_module_load_in_office_product_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2287,6 +2335,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process___connect_to_internet_with_hidden_window_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2779,6 +2831,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[print_processor_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[print_spooler_adding_a_printer_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2803,6 +2859,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_writing_dynamicwrapperx_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_tapping_keyboard_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2867,10 +2927,18 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[regsvr32_silent_param_dll_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remcos_rat_file_creation_in_remcos_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remcos_client_registry_install_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_desktop_network_bruteforce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -2955,6 +3023,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_shimcache_flush_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3031,6 +3103,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[screensaver_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[script_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3039,6 +3115,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sdelete_application_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[searchprotocolhost_with_no_command_line_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3047,6 +3127,14 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[serviceprincipalnames_discovery_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[serviceprincipalnames_discovery_with_setspn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[services_escalate_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3127,6 +3215,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_copy_on_system32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_curl_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3295,6 +3387,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[time_provider_persistence_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[trickbot_named_pipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3363,6 +3459,14 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[vbscript_execution_using_wscript_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[verclsid_clsid_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[w3wp_spawning_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3467,6 +3571,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winhlp32_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winword_spawning_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
@@ -3487,6 +3595,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wscript_or_cscript_suspicious_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[xmrig_driver_loaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/escu/default/savedsearches.conf
Vendored
+1858 -809
View File
File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More