From d828cd5d6b075ab78bf58ebaf52257bf8789eae7 Mon Sep 17 00:00:00 2001 From: Namratha Sreekanta Date: Fri, 19 May 2023 13:42:07 -0700 Subject: [PATCH] adding json file --- ...tration_using_pretrained_model_in_dsdl.yml | 154 +++++++++--------- ...ration_using_pretrained_model_in_dsdl.json | 1 + ...ration_using_pretrained_model_in_dsdl.yml} | 0 3 files changed, 77 insertions(+), 78 deletions(-) create mode 100644 notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json rename notebooks/{detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yaml => detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml} (100%) diff --git a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml index acb373402e..1cf93770a2 100644 --- a/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml +++ b/detections/network/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml @@ -1,113 +1,111 @@ +--- name: Detect DNS Data Exfiltration using pretrained model in DSDL id: 92f65c3a-968c-11ed-a1eb-0242ac120002 version: 1 -date: "2023-04-27" +date: 2023-04-27 status: experimental author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly datamodel: -- Network_Resolution + - Network_Resolution description: The following analytic uses a pre trained deep learning model to - detect DNS data exfiltration. The model is trained on the data we collected and is - inferred on live data. This detection detects low throughput DNS Tunneling (data exfiltration) using features computed from past events between - the same src and domain. The search uses macros from URL ToolBox app to generate features used by the model. - The model is a deep learning model that accepts DNS request as input along with a few custom features to generate a - pred_is_exfiltration_proba score. The higher the pred_is_exfiltration_proba, the more likely the DNS request is data exfiltration. - The threshold for flagging a request as DNS exfiltration is set at 0.5. -search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.src _time DNS.query -| `drop_dm_object_name("DNS")` -| sort - _time,src, query -| streamstats count as count by src query -| where count < 10 -| table src,query,count,_time -| apply dns_exfil11 -| table src,_time, query,count,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration -| where count == 1 -| rename pred_is_dns_data_exfiltration_proba as is_exfiltration_score -| rename pred_is_dns_data_exfiltration as is_exfiltration -| where is_exfiltration_score > 0.5 -| `security_content_ctime(_time)` -| rename src as "Source IP" _time as "time" -| table "Source IP","time","query","is_exfiltration_score","is_exfiltration" -| `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`' + detect DNS data exfiltration. The model is trained on the data we collected + and is inferred on live data. This detection detects low throughput DNS + Tunneling (data exfiltration) using features computed from past events between + the same src and domain. The search uses macros from URL ToolBox app to + generate features used by the model. The model is a deep learning model that + accepts DNS request as input along with a few custom features to generate a + pred_is_exfiltration_proba score. The higher the pred_is_exfiltration_proba, + the more likely the DNS request is data exfiltration. The threshold for + flagging a request as DNS exfiltration is set at 0.5. +search: '| tstats `security_content_summariesonly` count from + datamodel=Network_Resolution by DNS.src _time DNS.query | + `drop_dm_object_name("DNS")` | sort - _time,src, query | streamstats count as + count by src query | where count < 10 | table src,query,count,_time | apply + detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter | table + src,_time, + query,count,pred_is_dns_data_exfiltration_proba,pred_is_dns_data_exfiltration + | where count == 1 | rename pred_is_dns_data_exfiltration_proba as + is_exfiltration_score | rename pred_is_dns_data_exfiltration as + is_exfiltration | where is_exfiltration_score > 0.5 | + `security_content_ctime(_time)`| rename src as "Source IP" _time as "time" | + table "Source IP","time","query","is_exfiltration_score","is_exfiltration" | + `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter`' +how_to_implement: >- + Steps to deploy detect DNS data exfiltration model into Splunk + App DSDL. This detection depends on the Splunk app for Data Science and Deep + Learning which can be found here - https://splunkbase.splunk.com/app/4607/ and + the Network Resolution datamodel which can be found here - + https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained deep + learning model that needs to be deployed in DSDL app. Follow the steps for + deployment here - + `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\ -how_to_implement: 'Steps to deploy detect DNS data exfiltration model into Splunk App - DSDL. This detection depends on the Splunk app for Data Science and Deep - Learning which can be found here - https://splunkbase.splunk.com/app/4607/ - and the Network Resolution datamodel which can be found here - - https://splunkbase.splunk.com/app/1621/. The detection uses a pre-trained - deep learning model that needs to be deployed in DSDL app. Follow the steps - for deployment here - `https://github.com/splunk/security_content/wiki/How-to-deploy-pre-trained-Deep-Learning-models-for-ESCU`.\ + * Download the `artifacts .tar.gz` file from the link - https://seal.splunkresearch.com/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz Download the `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.ipynb` Jupyter notebook from https://github.com/splunk/security_content/notebooks\ - * Download the `artifacts .tar.gz` file from the link - https://seal.splunkresearch.com/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz - Download the `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.ipynb` - Jupyter notebook from https://github.com/splunk/security_content/notebooks\ - - * Login to the Jupyter Lab assigned for - detect_dns_data_exfiltration_using_pretrained_model_in_dsdl container. - This container should be listed on Containers page for DSDL app.\ + * Login to the Jupyter Lab assigned for detect_dns_data_exfiltration_using_pretrained_model_in_dsdl container. This container should be listed on Containers page for DSDL app.\ * Below steps need to be followed inside Jupyter lab \ - * Upload the detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz file - into `app/model/data` path using the upload option in the jupyter notebook.\ + * Upload the detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz file into `app/model/data` path using the upload option in the jupyter notebook.\ - * Untar the artifact detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz using `tar -xf app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz -C app/model/data`\ + * Untar the artifact detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.tar.gz using `tar -xf app/model/data/detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.tar.gz -C app/model/data`\ - * Upload detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab \ + * Upload detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.pynb into Jupyter lab notebooks folder using the upload option in Jupyter lab \ - * Save the notebook using the save option in jupyter notebook. \ + * Save the notebook using the save option in jupyter notebook. \ - * Upload `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json` into `notebooks/data` folder.' -known_false_positives: False positives may be present if DNS data exfiltration request look very similar to benign DNS requests. + * Upload `detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json` into `notebooks/data` folder. +known_false_positives: False positives may be present if DNS data exfiltration + request look very similar to benign DNS requests. references: -- https://attack.mitre.org/techniques/T1048/003/ -- https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/ -- https://en.wikipedia.org/wiki/Data_exfiltration + - https://attack.mitre.org/techniques/T1048/003/ + - https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/ + - https://en.wikipedia.org/wiki/Data_exfiltration tags: analytic_story: - - DNS Hijacking - - Suspicious DNS Traffic - - Command and Control + - DNS Hijacking + - Suspicious DNS Traffic + - Command and Control asset_type: Endpoint cis20: - - CIS 8 - - CIS 12 - - CIS 13 + - CIS 8 + - CIS 12 + - CIS 13 confidence: 90 context: - Source:Endpoint - Stage:Command And Control impact: 50 kill_chain_phases: - - Command & Control + - Command & Control message: A DNS data exfiltration request was sent by this host $src$ , kindly review. mitre_attack_id: - - T1048.003 + - T1048.003 nist: - - PR.DS - - PR.PT - - DE.AE - - DE.CM + - PR.DS + - PR.PT + - DE.AE + - DE.CM observable: - - name: query - type: Other - role: - - Attacker - - name: src - type: Hostname - role: - - Victim + - name: query + type: Other + role: + - Attacker + - name: src + type: Hostname + role: + - Victim product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud required_fields: - - _time - - DNS.message_type - - DNS.record_type - - DNS.src - - DNS.dest - - DNS.answer + - _time + - DNS.message_type + - DNS.record_type + - DNS.src + - DNS.dest + - DNS.answer risk_score: 45 - security_domain: network + security_domain: network \ No newline at end of file diff --git a/notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json b/notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json new file mode 100644 index 0000000000..78e38139a9 --- /dev/null +++ b/notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.json @@ -0,0 +1 @@ +{"options": {"params": {"mode": "stage", "algo": "detect_dns_data_exfiltration_using_pretrained_model_in_dsdl"}, "args": ["is_exfiltration", "src", "query", "rank"], "target_variable": ["is_exfiltration"], "feature_variables": ["src", "query", "rank"], "model_name": "detect_dns_data_exfiltration_using_pretrained_model_in_dsdl", "algo_name": "MLTKContainer", "mlspl_limits": {"handle_new_cat": "default", "max_distinct_cat_values": "100", "max_distinct_cat_values_for_classifiers": "100", "max_distinct_cat_values_for_scoring": "100", "max_fit_time": "600", "max_inputs": "100000", "max_memory_usage_mb": "4000", "max_model_size_mb": "30", "max_score_time": "600", "use_sampling": "true"}, "kfold_cv": null}, "feature_variables": ["src", "query", "rank"], "target_variables": ["is_exfiltration"]} \ No newline at end of file diff --git a/notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yaml b/notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml similarity index 100% rename from notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yaml rename to notebooks/detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml