Branch was auto-updated.

detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml

@@ -17,7 +17,8 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null),
   signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)),
   authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
+  "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND dest_device_id != null
@@ -34,7 +35,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
-  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
+  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id", event_id, "total_kerberos",
   totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
   endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
 

detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml

@@ -19,8 +19,8 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string",
   null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string",
   null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
-
+  "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND origin_device_id != null
 
@@ -36,7 +36,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
-  origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
+  origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos, "total_ntlm",
   totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
   startNTLMTime, "detection_end_time", endNTLMTime])
 

dist/ssa/detections/sdelete_application_execution.yml

@@ -1,94 +0,0 @@
-author: Teoderick Contreras, Splunk
-datamodel:
-- Endpoint_Processes
-date: '2021-11-15'
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-id: fcc52b9a-4616-11ec-8454-acde48001122
-known_false_positives: False positives should be limited, filter as needed.
-name: Sdelete Application Execution
-product:
-- Splunk Behavioral Analytics
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
-risk_message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-  delete files.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
-tags:
-  analytic_story:
-  - Information Sabotage
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Execution
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
-  impact: 60
-  kill_chain_phases:
-  - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
-  observable:
-  - name: dest
-    role:
-    - Victim
-    type: Endpoint
-  - name: user
-    role:
-    - Victim
-    type: User
-  - name: process_name
-    role:
-    - Child Process
-    type: Process
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest
-  - user
-  - parent_process_name
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_path
-  risk_score: 42
-  risk_severity: medium
-  security_domain: endpoint
-type: Anomaly
-version: 1

dist/ssa/detections/ssa___anomalous_usage_of_archive_tools.yml

@@ -81,5 +81,16 @@ tags:
   risk_score: 42
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Anomalous usage of Archive Tools Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test for Anomalous usage of Archive Tools
+    file: endpoint/ssa___anomalous_usage_of_archive_tools.yml
+    name: Anomalous usage of Archive Tools
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1

dist/ssa/detections/ssa___attempt_to_delete_services.yml

@@ -12,8 +12,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-known_false_positives: unknown
-name: Attempt To delete Services
+known_false_positives: It is possible administrative scripts may start/stop/delete
+  services. Filter as needed.
+name: Attempt To Delete Services
 product:
 - Splunk Behavioral Analytics
 references:

dist/ssa/detections/ssa___delete_a_net_user.yml

@@ -99,6 +99,9 @@ test:
     - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
       file_name: net_user_del.log
       source: WinEventLog:Security
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
+      file_name: security.log
+      source: WinEventLog:Security
     description: Test for usage of net.exe or net1.exe to delete net user
     file: endpoint/ssa___delete_a_net_user.yml
     name: Delete A Net User

dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -1,6 +1,7 @@
 author: Ignacio Bermudez Corrales, Splunk
-datamodel: []
-date: '2021-11-10'
+datamodel:
+- Endpoint_Processes
+date: '2020-11-10'
 description: The following analytic identifies parent processes, browsers, Windows
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -21,8 +22,7 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events()
-
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",

dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml

@@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   dest_device_id=       ucast(map_get(input_event, "dest_device_id"), "string", null),
   signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string", null)),
   authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
 
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND dest_device_id != null
@@ -43,9 +43,10 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
-  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
-  totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
-  endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
+  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
+  event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
+  startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
+  endNTLMTime])
 
   | into write_ssa_detected_events();'
 tags:

dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml

@@ -29,8 +29,7 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"), "string",
   null), signature_id=   lower(ucast(map_get(input_event, "signature_id"), "string",
   null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
-  "string", null))
-
+  "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
   | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
   AND dest_user_id != null AND origin_device_id != null
 
@@ -46,9 +45,9 @@ search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamode
   (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
 
   | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
-  origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
-  totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
-  startNTLMTime, "detection_end_time", endNTLMTime])
+  origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
+  "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
+  endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
 
   | into write_ssa_detected_events();'
 tags:

dist/ssa/detections/ssa___sdelete_application_execution.yml

@@ -1,6 +1,6 @@
 author: Teoderick Contreras, Splunk
 datamodel:
-- Endpoint
+- Endpoint_Processes
 date: '2021-11-15'
 description: This analytic will detect the execution of sdelete.exe attempting to
   delete potentially important files that may related to adversary or insider threats