Branch was auto-updated.

baselines/splunk_risky_command_abuse_ml_detection_baseline.yml

@@ -0,0 +1,71 @@
+name: Splunk Risky Command Abuse ML Detection Baseline
+id: 273df2f7-643a-451a-8d4d-637e39eadc87
+version: 1
+date: '2022-05-27'
+author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
+type: Baseline
+datamodel:
+- Splunk_Audit
+description: 'This search is to build a per user risky command abuse detection model using MLTK DensityFunction 
+  algorithm based on audit log data of Splunk apps. The model is built from past 7 days users history of running 
+  search commands containing risky keywords, and aggregate the total search run time for each hour as indicator of 
+  user behavior. The default threshold of outlier boundary is defined as 0.1%. This search should be scheduled to 
+  run at least as frequently as every 7 days to build a recent baseline for each user. The name of ML model 
+  generated is "risky_command_abuse" and should be configured as global (not private) in MLTK app, unless the same 
+  account of training this model will be used to perfeorm inference using this model for anomaly detection. 
+  The corresponding detection of using this model is "Splunk Risky Command Abuse ML Detection". '
+search: '| tstats values(Search_Activity.user) as user, sum(Search_Activity.total_run_time) as run_time count 
+  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
+  AND (Search_Activity.total_run_time>1) AND (earliest=-7d@d latest=now) 
+  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
+  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
+  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
+  BY _time, Search_Activity.user span=1h 
+  | fit DensityFunction "run_time" dist=auto threshold=0.001 show_density=true by "user" into "risky_command_abuse" '
+how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. 
+  For large enterprises, training the model might take significant computing resources, and might 
+  need to incresase MLTK DensityFunction settings default values, such as max_fit_time, max_groups, etc.
+known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of
+  a search exceeds the boundaries of outlier defined by the fitted density function model. 
+references:
+- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 6
+  confidence: 40
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: ML model "risky_command_abuse" training is completed.
+  mitre_attack_id:
+  - T1203
+  nist:
+  - DE.AE
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Search_Activity.search
+  - Search_Activity.total_run_time 
+  - Search_Activity.user 
+  - Search_Activity.search_type
+  risk_score: 20
+  security_domain: audit
+  detections: 
+  - Splunk Risky Command Abuse ML Detection
+

detections/application/splunk_risky_command_abuse_ml_detection.yml

@@ -0,0 +1,67 @@
+name: Splunk Risky Command Abuse ML Detection
+id: 19d0146c-2eae-4e53-8d39-1198a78fa9ca
+version: 1
+date: '2022-05-27'
+author: Abhinav Mishra, Kumar Sharad and Xiao Lin, Splunk
+type: Anomaly
+datamodel:
+- Splunk_Audit
+description: 'This detection utilize machine learning model named "risky_command_abuse" trained from "Splunk 
+  Risky Command Abuse ML Model Baseline". It should be scheduled to run every hour 
+  to detect whether a user has run searches containing risky keywords with abnormal long running time in the 
+  past two hours, comparing with his/her past seven days history. '
+search: '| tstats values(Search_Activity.user) AS user, sum(Search_Activity.total_run_time) AS run_time,
+  values(Search_Activity.search) as searches, count 
+  FROM datamodel=Splunk_Audit.Search_Activity WHERE (Search_Activity.user!="") 
+  AND (Search_Activity.total_run_time>1) AND (earliest=-2h@h latest=now) 
+  AND (Search_Activity.search IN ("*| runshellscript *", "*| collect *","*| delete *", "*| fit *", "*| outputcsv *", 
+  "*| outputlookup *", "*| run *", "*| script *", "*| sendalert *", "*| sendemail *", "*| tscollect *")) 
+  AND (Search_Activity.search_type=adhoc) AND (Search_Activity.user!=splunk-system-user) 
+  BY _time, Search_Activity.user span=1h 
+  | apply risky_command_abuse
+  | fields _time, user, searches, run_time, IsOutlier(run_time)
+  | rename IsOutlier(run_time) as isOutlier, _time as timestamp
+  | where isOutlier>0.5 | `splunk_risky_command_abuse_ml_detection_filter`'
+how_to_implement: This detection depends on MLTK and assumes Splunk audit data model is available. 
+known_false_positives: Benigh search of long run time will be flagged as positive (false), if the run time of 
+  a search exceeds the boundaries of outlier defined by the fitted density function model. 
+references:
+- https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning
+tags:
+  analytic_story:
+  - Splunk Vulnerabilities
+  asset_type: Web Server
+  cis20:
+  - CIS 3
+  - CIS 6
+  confidence: 40
+  context:
+  - Source:Endpoint
+  dataset:
+  - https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: $user used abnormally long run time for searches with risky command.
+  mitre_attack_id:
+  - T1203
+  nist:
+  - DE.AE
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Search_Activity.search 
+  - Search_Activity.total_run_time 
+  - Search_Activity.user 
+  - Search_Activity.search_type
+  risk_score: 20
+  security_domain: audit
+  

tests/application/splunk_risky_command_abuse_ml_detection.test.yml

@@ -0,0 +1,20 @@
+name: Splunk Risky Command Abuse ML Detection Unit Test
+tests:
+- name: Splunk Risky Command Abuse ML Detection
+  file: application/splunk_risky_command_abuse_ml_detection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -1h
+  latest_time: now
+  baselines:
+  - name: Splunk Risky Command Abuse ML Detection Baseline
+    file: baselines/splunk_risky_command_abuse_ml_detection_baseline.yml
+    pass_condition: '| stats count | where count > 0'
+    earliest_time: -7d
+    latest_time: now
+  attack_data: 
+  - file_name: search_activity.json
+    data: https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt
+    source: audittrail
+    sourcetype: audittrail
+    update_timestamp: true
+    custom_index: _audit