admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-15 14:05:09 -07:00
committed by GitHub
parent 0671174069 3b6ec5dbdb
commit d3a3bcff30
10 changed files with 51 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Detect Regasm with no Command Line Arguments
id: c3bc1430-04e7-4178-835f-047d8e6e97df
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where `process_regasm` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
| regex process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Detect Regsvcs with No Command Line Arguments
id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
| regex process="(?i)(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+8 -8
View File
@@ -1,7 +1,7 @@
name: DLLHost with no Command Line Arguments with Network
id: f1c07594-a141-11eb-8407-acde48001122
version: 2
date: '2021-10-13'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -13,14 +13,14 @@ description: The following analytic identifies DLLHost.exe with no command line
parallel processes. Identify any suspicious module loads related to credential dumping
or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid
where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid
Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC]
| table _time dest parent_process_name process_name process_path process process_guid
connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`'
| regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
| table _time dest parent_process_name process_name process_path process process_id dest_port C2
| `dllhost_with_no_command_line_arguments_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+8 -8
View File
@@ -1,7 +1,7 @@
name: GPUpdate with no Command Line Arguments with Network
id: 2c853856-a140-11eb-a5b5-acde48001122
version: 1
date: '2021-04-19'
version: 2
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -14,14 +14,14 @@ description: The following analytic identifies gpupdate.exe with no command line
dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and
C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid
where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(gpupdate\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly`
count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid
Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC]
| table _time dest parent_process_name process_name process_path process process_guid
connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`'
| regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
| table _time dest parent_process_name process_name process_path process process_id dest_port C2
| `gpupdate_with_no_command_line_arguments_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node.
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+9 -8
View File
@@ -1,7 +1,7 @@
name: Rundll32 with no Command Line Arguments with Network
id: 35307032-a12d-11eb-835f-acde48001122
version: 3
date: '2021-10-13'
version: 4
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -14,14 +14,15 @@ description: The following analytic identifies rundll32.exe with no command line
dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name
where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" |
join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`'
| `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)"
| join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
| table _time dest parent_process_name process_name process_path process process_id dest_port C2
| `rundll32_with_no_command_line_arguments_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+8 -8
View File
@@ -1,7 +1,7 @@
name: SearchProtocolHost with no Command Line with Network
id: b690df8c-a145-11eb-a38b-acde48001122
version: 2
date: '2021-10-13'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -14,14 +14,14 @@ description: The following analytic identifies searchprotocolhost.exe with no co
related to credential dumping or file writes. searchprotocolhost.exe is natively
found in C:\Windows\system32 and C:\Windows\syswow64.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats
`security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
!="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ]
| table _time dest parent_process_name process_name process_path process process_id dest_port C2
| `searchprotocolhost_with_no_command_line_with_network_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Suspicious DLLHost no Command Line Arguments
id: ff61e98c-0337-4593-a78f-72a676c56f26
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
| regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Suspicious GPUpdate no Command Line Arguments
id: f308490a-473a-40ef-ae64-dd7a6eba284a
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`'
| regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Suspicious Rundll32 no Command Line Arguments
id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
| regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Suspicious SearchProtocolHost no Command Line Arguments
id: f52d2db8-31f9-4aa7-a176-25779effe55c
version: 2
date: '2021-09-20'
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
type: TTP
datamodel:
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| regex process="(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,