diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index e9538f85fd..2e38b9b197 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -1,7 +1,7 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -9,10 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" - Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime - by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `adsisearcher_account_discovery_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime + by EventCode Computer ScriptBlockText UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. @@ -30,7 +28,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log impact: 50 kill_chain_phases: - Reconnaissance @@ -39,11 +37,11 @@ tags: - T1087.002 - T1087 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index f061a9f684..8a8b60d48c 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 -version: 1 -date: '2021-08-24' +version: 2 +date: '2022-09-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: [] @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or @@ -30,7 +30,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log impact: 50 kill_chain_phases: - Reconnaissance diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index c3f3fe2e49..11aef9f1cc 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Get DomainUser with PowerShell Script Block id: 61994268-04f4-11ec-865c-acde48001122 -version: 2 -date: '2022-03-22' +version: 3 +date: '2022-11-13' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' @@ -38,11 +38,11 @@ tags: - T1087.002 - T1087 observable: - - name: ComputerName + - name: Computer type: Hostname role: - Victim - - name: User + - name: UserID type: User role: - Victim diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 45e58f02e7..5e413213f3 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -1,7 +1,7 @@ name: Recursive Delete of Directory In Batch CMD id: ba570b3a-d356-11eb-8358-acde48001122 -version: 2 -date: '2021-06-22' +version: 3 +date: '2022-11-12' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,8 +11,8 @@ description: This search is to detect a suspicious commandline designed to delet (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process=* - rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name + as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process="* + rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`' diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml index f9cb59a258..109265fc2e 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI and PowerShell Script Block id: 2a048c14-4634-11ec-a618-3e22fbd008af -version: 1 -date: '2021-11-15' +version: 2 +date: '2022-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -9,10 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution. -search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" - AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count - min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName - User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -30,7 +27,7 @@ tags: - Source:Endpoint - Stage:Lateral Movement dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log impact: 90 kill_chain_phases: - Exploitation diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index 90587f65be..82d9c2ac84 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -1,6 +1,6 @@ name: Svchost LOLBAS Execution Process Spawn id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -version: 1 +version: 2 date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP @@ -50,7 +50,7 @@ tags: impact: 90 kill_chain_phases: - Exploitation - message: Svchost.exe spawned a LOLBAS process on $dest + message: Svchost.exe spawned a LOLBAS process on $dest$ mitre_attack_id: - T1053 - T1053.005 diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml index 17f130c5bf..a9e623de53 100644 --- a/tests/endpoint/adsisearcher_account_discovery.test.yml +++ b/tests/endpoint/adsisearcher_account_discovery.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: adsisearcher_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml index 9c45b48d09..8aaca00268 100644 --- a/tests/endpoint/get_aduser_with_powershell_script_block.test.yml +++ b/tests/endpoint/get_aduser_with_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + - file_name: aduser_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml index 63e192f7db..91d6e02da2 100644 --- a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml +++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: wineventlog + - file_name: wmi_remote_process_powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog