mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge pull request #2553 from splunk/remove_ba_deprexperi
remove it from 3.61.0
This commit is contained in:
mvelazco
@@ -1,85 +0,0 @@
|
||||
name: Credential ExtractionFGDump and CacheDump
|
||||
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
|
||||
version: 2
|
||||
date: '2021-11-29'
|
||||
author: Stanislav Miskovic, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: The following analytic identifies the use of CacheDump with the `-v`
|
||||
parameter to dump cached credentials on the associated endpoint. Adversaries use
|
||||
Cachedump as it is a publicly-available tool that extracts cached password hashes
|
||||
from a system's registry.
|
||||
search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
|
||||
/(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
|
||||
AND match_regex(cmd_line, /(?i)\-v/)=true
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: False positives will be limited as this analytic targets specific
|
||||
credential dumping process names. Filter as needed.
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
|
||||
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Child Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 63
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
-97
@@ -1,97 +0,0 @@
|
||||
name: Potential Pass the Token or Hash Observed at the Destination Device
|
||||
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
|
||||
version: 3
|
||||
date: '2021-11-30'
|
||||
author: Stanislav Miskovic, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Authentication
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential
|
||||
stealing. We detect the main side effect of these attacks, which is a transition
|
||||
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
|
||||
by a detination device.
|
||||
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string",
|
||||
null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null),
|
||||
dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
|
||||
authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
|
||||
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
|
||||
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
|
||||
AND dest_user_id != null AND dest_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
|
||||
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
|
||||
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
|
||||
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
|
||||
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
|
||||
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
|
||||
event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
|
||||
startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
|
||||
endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
|
||||
i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for
|
||||
benign purposes (such as a rare use of SMB shares).
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or
|
||||
Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the destination device $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
- authentication_method
|
||||
risk_score: 72
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
|
||||
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
|
||||
version: 2
|
||||
date: '2021-11-05'
|
||||
author: Stanislav Miskovic, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Authentication
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential
|
||||
stealing. We detect the main side effect of these attacks, which is a transition
|
||||
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
|
||||
by an event-collecting device (i.e., a specific domain controller or an endpoint
|
||||
destination).
|
||||
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
|
||||
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string",
|
||||
null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string",
|
||||
null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
|
||||
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
|
||||
AND dest_user_id != null AND origin_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
|
||||
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
|
||||
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
|
||||
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
|
||||
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
|
||||
origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
|
||||
"total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
|
||||
endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest
|
||||
- at least from domain controllers. Please make sure that event ID 4624 is being
|
||||
logged.
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for
|
||||
benign purposes (such as a rare use of SMB shares).
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or
|
||||
Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the logging device $origin_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: origin_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- origin_device_id
|
||||
- authentication_method
|
||||
risk_score: 64
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
@@ -1,92 +0,0 @@
|
||||
name: Unusual LOLBAS in short period of time
|
||||
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
|
||||
version: 2
|
||||
date: '2020-08-25'
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: Attacker activity may compromise executing several LOLBAS applications
|
||||
in conjunction to accomplish their objectives. We are looking for more than usual
|
||||
LOLBAS applications over a window of time, by building profiles per machine.
|
||||
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
|
||||
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
|
||||
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
|
||||
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
|
||||
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
|
||||
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
|
||||
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
|
||||
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
|
||||
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
|
||||
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
|
||||
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
|
||||
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
|
||||
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
|
||||
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
|
||||
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
|
||||
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
|
||||
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
|
||||
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
|
||||
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
|
||||
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
|
||||
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
|
||||
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
|
||||
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
|
||||
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
|
||||
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
|
||||
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
|
||||
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
|
||||
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
|
||||
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
|
||||
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
|
||||
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
|
||||
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
|
||||
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
|
||||
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
|
||||
applications in a short period of time. This might trigger false positives at the
|
||||
beginning when it hasn''t collected yet enough data to construct the baseline.
|
||||
|
||||
'
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
|
||||
period of time in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1053
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: process_name
|
||||
type: Process
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- _time
|
||||
- process_name
|
||||
risk_score: 25
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,73 +0,0 @@
|
||||
name: Unusually Long Command Line
|
||||
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
|
||||
version: 1
|
||||
date: '2020-10-06'
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: Command lines that are extremely long may be indicative of malicious
|
||||
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
|
||||
to help identify command lines with lengths that are unusual for a given user. This
|
||||
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
|
||||
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
|
||||
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
|
||||
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
|
||||
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
|
||||
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
|
||||
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
|
||||
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
|
||||
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
|
||||
lines.
|
||||
known_false_positives: This detection may flag suspiciously long command lines when
|
||||
there is not sufficient evidence (samples) for a given process that this detection
|
||||
is tracking; or when there is high variability in the length of the command line
|
||||
for the tracked process. Also, some legitimate applications may use long command
|
||||
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
|
||||
Attackers may use this technique to obfuscate their payloads.
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 40
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ with a long commandline $cmd_line$ executed in
|
||||
host $dest_device_id$
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 12
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,61 +0,0 @@
|
||||
name: Anomalous Usage of Account Credentials
|
||||
id: 629cbf9e-5785-11ec-9611-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-07'
|
||||
author: Lou Stella, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: This is an anomaly generating detection looking for multiple interactive
|
||||
logins within a specific time period. An insider threat may attempt to steal colleagues
|
||||
credentials in low tech, undetectable methods, in order to gain access to additional
|
||||
information or to hide their own behavior. This should capture their attempted use
|
||||
of those credentials on a workstation.
|
||||
search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"),
|
||||
"string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string",
|
||||
null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where
|
||||
signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM")
|
||||
AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by
|
||||
device, span(timestamp, 600s, 300s) | where user_counter>=2 | rename window_end
|
||||
AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device),
|
||||
body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this detection, you need to be ingesting
|
||||
logon events from workstations.
|
||||
known_false_positives: Shared workstations can cause false positives
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1078/002/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Insider Threat
|
||||
cis20:
|
||||
- CIS 14
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
|
||||
impact: 20
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Multiple interactive logins detected on $device$
|
||||
mitre_attack_id:
|
||||
- T1078.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- DE.AE
|
||||
observable:
|
||||
- name: device
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
risk_score: 6
|
||||
risk_severity: low
|
||||
security_domain: access
|
||||
asset_type: Endpoint
|
||||
@@ -1,79 +0,0 @@
|
||||
name: Detect Kerberoasting
|
||||
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
|
||||
version: 2
|
||||
date: '2020-10-21'
|
||||
author: Xiao Lin, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: This search detects a potential kerberoasting attack via service principal
|
||||
name requests
|
||||
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
|
||||
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
|
||||
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
|
||||
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
|
||||
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
|
||||
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
|
||||
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
|
||||
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
|
||||
| eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id,
|
||||
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
|
||||
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();'
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
|
||||
generate false positives
|
||||
references:
|
||||
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 16
|
||||
confidence: 20
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Kerberoasting malware is potentially applying stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1558.003
|
||||
- T1558
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: cmd_line
|
||||
type: Process
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- service_name
|
||||
- _time
|
||||
- event_code
|
||||
- ticket_encryption_type
|
||||
- service_id
|
||||
- ticket_options
|
||||
risk_score: 14
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,73 +0,0 @@
|
||||
name: Disable Defender AntiVirus Registry
|
||||
id: aa4f115a-3024-11ec-9987-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-08'
|
||||
author: Bhavin Patel, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint_Registry
|
||||
description: This particular behavior is typically executed when an adversaries or
|
||||
malware gains access to an endpoint and beings to perform execution and to evade
|
||||
detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
|
||||
task modifications will occur. During triage, review parallel processes and identify
|
||||
any further file modifications. Endpoint should be isolated.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
|
||||
"string", null)), registry_path=lower(ucast(map_get(input_event, "registry_path"),
|
||||
"string", null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
|
||||
"string", null)), registry_value_data=ucast(map_get(input_event, "registry_value_data"),
|
||||
"string", null), process_guid=ucast(map_get(input_event, "process_guid"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
like(registry_path, "%\\Policies\\Microsoft\\Windows Defender%") AND registry_key_name="DisableAntiVirus"
|
||||
AND registry_value_data="(0x00000001)" | eval start_time=timestamp, end_time=timestamp,
|
||||
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null)), body=create_map( [ "event_id", event_id, "registry_path",
|
||||
registry_path, "registry_key_name", registry_key_name, "process_guid", process_guid,"registry_value_data",registry_value_data])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the registry value name, registry path, and registry value data from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: Admin or user may choose to disable windows defender product
|
||||
references:
|
||||
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
|
||||
tags:
|
||||
analytic_story:
|
||||
- IcedID
|
||||
automated_detection_testing: passed
|
||||
cis20: []
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Modified/added/deleted registry entry $registry_path$ in $dest$
|
||||
mitre_attack_id:
|
||||
- T1562.001
|
||||
- T1562
|
||||
nist: []
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- Registry.dest
|
||||
- Registry.user
|
||||
- Registry.registry_value_name
|
||||
- Registry.registry_key_name
|
||||
- Registry.registry_path
|
||||
- Registry.registry_value_data
|
||||
risk_score: 49
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,63 +0,0 @@
|
||||
name: Excessive Number of Office Files Copied
|
||||
id: 3c6594a9-8df6-45a1-9357-d73b62083c63
|
||||
version: 1
|
||||
date: '2021-12-07'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Filesystem
|
||||
description: This detection detects a high amount of office file copied. This can
|
||||
be an indicator for a malicious insider.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
|
||||
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
|
||||
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
|
||||
| where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name,
|
||||
"%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name)
|
||||
AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20
|
||||
| eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
|
||||
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
|
||||
known_false_positives: user may copy a lot of office fies from one folder to another
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Insider Threat
|
||||
cis20: []
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Exfiltration
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: High number of files copied
|
||||
mitre_attack_id:
|
||||
- T1048.003
|
||||
nist: []
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- action
|
||||
- process
|
||||
- file_name
|
||||
- file_path
|
||||
risk_score: 72
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,86 +0,0 @@
|
||||
name: First time seen command line argument
|
||||
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
|
||||
version: 4
|
||||
date: '2021-11-30'
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: This search looks for command-line arguments that use a `/c` parameter
|
||||
to execute a command that has not previously been seen. This is an implementation
|
||||
on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following
|
||||
analytic identifies first time seen command-line arguments on a single endpoint.
|
||||
The analytic looks for arguments instantiated by `cmd.exe /c` and the associated
|
||||
command-line. Adversaries automate or spawn multiple processes using this method,
|
||||
this analytic may assist with identifying the first time it's been found on this
|
||||
endpoint.'
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
|
||||
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
|
||||
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
|
||||
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
|
||||
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
|
||||
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
|
||||
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
|
||||
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
|
||||
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
|
||||
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
|
||||
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: Legitimate programs use command-line arguments to execute.
|
||||
Verify the command-line arguments to check what command/program is being executed.
|
||||
Filtering will be needed.
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 8
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Command & Control
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ ha been identified in the environment with a command-line
|
||||
$cmd_line$ not previously seen before on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1202
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 30
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,75 +0,0 @@
|
||||
name: High File Deletion Frequency
|
||||
id: b6200efd-13bd-4336-920a-057b25bbcfaf
|
||||
version: 1
|
||||
date: '2021-12-07'
|
||||
author: Patrick Bareiss, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Filesystem
|
||||
description: This detection detects a high amount of file deletions in a short time
|
||||
for specific file types. This can be an indicator for a malicious insider.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
|
||||
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
|
||||
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
|
||||
| where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name,
|
||||
"%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name,
|
||||
"%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name,
|
||||
"%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name,
|
||||
"%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name,
|
||||
"%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name,
|
||||
"%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name,
|
||||
"%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp,
|
||||
10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
|
||||
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
|
||||
known_false_positives: user may delete bunch of pictures or files in a folder.
|
||||
references:
|
||||
- https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft
|
||||
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Clop Ransomware
|
||||
- Insider Threat
|
||||
cis20: []
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: High frequency file deletion activity detected on host $Computer$
|
||||
mitre_attack_id:
|
||||
- T1485
|
||||
nist: []
|
||||
observable:
|
||||
- name: user
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: Computer
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
- name: deleted_files
|
||||
type: File Name
|
||||
role:
|
||||
- Target
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- action
|
||||
- process
|
||||
- file_name
|
||||
- file_path
|
||||
risk_score: 72
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
@@ -1,102 +0,0 @@
|
||||
name: Rare Parent-Child Process Relationship
|
||||
id: cf090c78-bcc6-11eb-8529-0242ac130003
|
||||
version: 2
|
||||
date: '2021-11-30'
|
||||
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: An attacker may use LOLBAS tools spawned from vulnerable applications
|
||||
not typically used by system administrators. This analytic leverages the Splunk
|
||||
Streaming ML DSP plugin to find rare parent/child relationships. The list of application
|
||||
has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
|
||||
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
|
||||
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
|
||||
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
|
||||
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
|
||||
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
|
||||
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
|
||||
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
|
||||
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
|
||||
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
|
||||
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
|
||||
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
|
||||
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
|
||||
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
|
||||
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
|
||||
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
|
||||
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
|
||||
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
|
||||
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
|
||||
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
|
||||
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
|
||||
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
|
||||
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
|
||||
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
|
||||
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
|
||||
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
|
||||
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
|
||||
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
|
||||
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
|
||||
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
|
||||
window=604800000L | where label AND input > mean | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
|
||||
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
|
||||
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
|
||||
cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
|
||||
known_false_positives: Some custom tools used by administrators could be used rarely
|
||||
to launch remotely applications. This might trigger false positives at the beginning
|
||||
when it has not collected yet enough data to construct the baseline.
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
context:
|
||||
- Source:Endpoint
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Rare Parent-Child Process Relationship
|
||||
mitre_attack_id:
|
||||
- T1203
|
||||
- T1059
|
||||
- T1053
|
||||
- T1072
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Actor
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
required_fields:
|
||||
- process
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
confidence: 50
|
||||
impact: 50
|
||||
risk_score: 25
|
||||
asset_type: Endpoint
|
||||
@@ -1,78 +0,0 @@
|
||||
name: Windows WSReset UAC Bypass
|
||||
id: 3118f0c2-90d9-11ec-b833-acde48001122
|
||||
version: 1
|
||||
date: '2022-02-18'
|
||||
author: Lou Stella, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Registry
|
||||
description: This analytic is built to detect a suspicious modification of the Windows
|
||||
registry related to UAC bypass. This technique is to modify the registry in this
|
||||
detection, create a registry value with the path of the payload and run WSreset.exe
|
||||
to bypass User Account Control.
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Registry" IN (_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
registry_path=lower(ucast(map_get(input_event, "registry_path"), "string", null)),
|
||||
registry_hive=lower(ucast(map_get(input_event, "registry_hive"), "string", null)),
|
||||
registry_value_name=lower(ucast(map_get(input_event, "registry_value_name"), "string",
|
||||
null)), registry_key_name=lower(ucast(map_get(input_event, "registry_key_name"),
|
||||
"string", null)), registry_value_type=lower(ucast(map_get(input_event, "registry_value_type"),
|
||||
"string", null)), registry_value_data=lower(ucast(map_get(input_event, "registry_value_data"),
|
||||
"string", null)), process_guid=lower(ucast(map_get(input_event, "process_guid"),
|
||||
"string", null)) | where registry_path IS NOT NULL AND registry_value_name IS NOT
|
||||
NULL and like (registry_path, "%\\\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\\\Shell\\\\open\\\\command%")
|
||||
AND (registry_value_name="(Default)" OR registry_value_name="DelegateExecute") |
|
||||
eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | eval body=create_map(["registry_path", registry_path, "registry_hive",
|
||||
registry_hive, "registry_value_name", registry_value_name, "registry_key_name",
|
||||
registry_key_name, "registry_value_type", registry_value_type, "registry_value_data",
|
||||
registry_value_data, "process_guid", process_guid]) | into write_ssa_detected_events(); '
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Registry` datamodel.
|
||||
known_false_positives: Unknown at this point in time.
|
||||
references:
|
||||
- https://github.com/hfiref0x/UACME
|
||||
- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
|
||||
tags:
|
||||
analytic_story:
|
||||
- Living Off The Land
|
||||
- Windows Defense Evasion Tactics
|
||||
cis20:
|
||||
- CIS 14
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Persistence
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Defense Evasion
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: tbd
|
||||
mitre_attack_id:
|
||||
- T1548.002
|
||||
- T1548
|
||||
nist:
|
||||
- DE.AE
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- registry_path
|
||||
- registry_hive
|
||||
- registry_value_name
|
||||
- registry_key_name
|
||||
- registry_value_type
|
||||
- registry_value_data
|
||||
- process_guid
|
||||
risk_score: 63
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
asset_type: Endpoint
|
||||
-84
@@ -1,84 +0,0 @@
|
||||
name: TCP Command and Scripting Interpreter Outbound LDAP Traffic
|
||||
id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449
|
||||
version: 1
|
||||
date: '2022-02-17'
|
||||
author: Jose Hernandez, Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
description: Malicious actors often abuse misconfigured LDAP servers or applications
|
||||
that use the LDAP servers in organizations. Outbound LDAP traffic should not be
|
||||
allowed outbound through your perimeter firewall. This search will help determine
|
||||
if you have any LDAP connections to IP addresses outside of private (RFC1918) address
|
||||
space.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"),
|
||||
"collection<string>", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636
|
||||
| where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip,
|
||||
cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12"))
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port,
|
||||
"dest_ip", dest_ip]) | into write_ssa_detected_events();'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on network traffic, specifically data that populates the Network_Traffic datamodel.
|
||||
To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic
|
||||
events.
|
||||
known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
|
||||
allowed outbound through your perimeter firewall. Please check those servers to
|
||||
verify if the activity is legitimate.
|
||||
references:
|
||||
- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
|
||||
- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
|
||||
- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a
|
||||
tags:
|
||||
analytic_story:
|
||||
- Log4Shell CVE-2021-44228
|
||||
asset_type: endpoint
|
||||
cis20:
|
||||
- CIS 13
|
||||
confidence: 70
|
||||
context:
|
||||
- Scope:Outbound
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting
|
||||
to dest ip $dest_ip$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
type: User
|
||||
role:
|
||||
- Victim
|
||||
- name: dest_device_id
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
- name: parent_process_name
|
||||
type: Process
|
||||
role:
|
||||
- Parent Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: low
|
||||
security_domain: network
|
||||
-74
@@ -1,74 +0,0 @@
|
||||
name: Unusual Volume of Data Download from Internal Server Per Entity
|
||||
id: cca028f4-77dd-11ec-bc09-acde48001122
|
||||
version: 1
|
||||
date: '2022-01-17'
|
||||
author: Xiao Lin, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Network_Traffic
|
||||
description: Insider might conduct information collection before data exfiltration,
|
||||
and unusual volume of data download from internal server is an indicator of such
|
||||
potential threat. This detection evaluates the total bytes downloaded from internal
|
||||
servers at specific time window per entity level, and then flagged these that are
|
||||
higher than 99.999% percentile as an anamaly. A behavior will be reported as long
|
||||
as the downloaded byte volume is unusual even though that operation is benign, which
|
||||
causes false positive. It is therefore advised to adjust threshold and time window
|
||||
based on detection performance whenever necessary. It should be noted that seasonality
|
||||
is not modeled in the current approach.
|
||||
search: '| from read_ssa_enriched_events() | eval sourcetype = ucast(map_get(input_event,
|
||||
"sourcetype"), "string", null) | eval timestamp = parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | where sourcetype == "pan:traffic" | eval src_device_scope
|
||||
=ucast(map_get(input_event, "src_device_scope"), "string", null) | eval dest_device_scope=ucast(map_get(input_event,
|
||||
"dest_device_scope"), "string", null) | where src_device_scope IS NOT NULL AND dest_device_scope
|
||||
IS NOT NULL | eval dest_device = ucast(map_get(input_event, "dest_device_ips"),
|
||||
"collection<string>", [])[0] | where dest_device IS NOT NULL AND dest_device_scope
|
||||
== "INTERNAL" | eval src_device = ucast(map_get(input_event, "src_device_ips"),
|
||||
"collection<string>", [])[0] | where src_device IS NOT NULL AND src_device_scope
|
||||
== "INTERNAL" | eval bytes_in = ucast(map_get(input_event, "bytes_in"), "integer",
|
||||
0) | eval download_bytes = cast(bytes_in, "double") | eval tenant = ucast(map_get(input_event,
|
||||
"_tenant"), "string", null) | eval event_id = ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | adaptive_threshold algorithm="quantile" value="download_bytes"
|
||||
entity="dest_device" window=86400000L | where label AND quantile>0.99999 | eval
|
||||
end_time = timestamp | eval start_time = end_time - 86400000 | eval body = create_map(["event_id",
|
||||
event_id, "tenant", tenant]) | eval entities=mvappend(dest_device) | into write_ssa_detected_events();'
|
||||
how_to_implement: Ingest PAN traffic logs
|
||||
known_false_positives: Benign large volume data download might be flagged as (false)
|
||||
positive.
|
||||
references:
|
||||
- https://github.com/twitter/AnomalyDetection
|
||||
tags:
|
||||
analytic_story:
|
||||
- Insider Threat
|
||||
asset_type: endpoint
|
||||
cis20:
|
||||
- CIS 13
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
dataset:
|
||||
- https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Weaponization
|
||||
message: $src_device_ip downloaded unusually amount of data from internal server
|
||||
within one day
|
||||
mitre_attack_id:
|
||||
- T1213
|
||||
- T1039
|
||||
nist:
|
||||
- DE.AE
|
||||
observable:
|
||||
- name: src_device_ip
|
||||
type: IP Address
|
||||
role:
|
||||
- Other
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_scope
|
||||
- bytes_in
|
||||
- src_device_ips
|
||||
risk_score: 25
|
||||
risk_severity: low
|
||||
security_domain: network
|
||||
@@ -1,66 +0,0 @@
|
||||
name: SSL Certificates with Punycode
|
||||
id: 696694df-5706-495a-81f2-79501fa11b90
|
||||
version: 1
|
||||
date: '2022-11-01'
|
||||
author: Michael Haag, Splunk
|
||||
type: Hunting
|
||||
datamodel: []
|
||||
description: The following analytic utilizes the Certificates Datamodel to look for punycode domains, starting with xn--, found in the SSL issuer email domain.
|
||||
The presence of punycode here does not equate to evil, therefore we need to decode the punycode to determine what it translates to. Remove the CyberChef recipe as needed and decode manually.
|
||||
Note that this is not the exact location of the malicious punycode to trip CVE-2022-3602, but a method to at least identify fuzzing occurring on these email paths.
|
||||
What does evil look like? it will start with
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Certificates.All_Certificates by All_Certificates.SSL.ssl_issuer_email_domain All_Certificates.SSL.ssl_issuer All_Certificates.SSL.ssl_subject_email All_Certificates.SSL.dest All_Certificates.SSL.src All_Certificates.SSL.sourcetype All_Certificates.SSL.ssl_subject_email_domain
|
||||
| `drop_dm_object_name("All_Certificates.SSL")`
|
||||
| eval punycode=if(like(ssl_issuer_email_domain,"%xn--%"),1,0)
|
||||
| where punycode=1
|
||||
| cyberchef infield="ssl_issuer_email_domain" outfield="convertedPuny" jsonrecipe="[{"op":"From Punycode","args":[true]}]"
|
||||
| table ssl_issuer_email_domain convertedPuny ssl_issuer ssl_subject_email dest src sourcetype ssl_subject_email_domain
|
||||
| `ssl_certificates_with_punycode_filter`'
|
||||
how_to_implement: Ensure data is properly being ingested into the Certificates datamodel. If decoding the of interest, the CyberChef app is needed https://splunkbase.splunk.com/app/5348. If decoding is not needed, remove the cyberchef lines.
|
||||
known_false_positives: False positives may be present if the organization works with international businesses. Filter as needed.
|
||||
references:
|
||||
- https://www.splunk.com/en_us/blog/security/nothing-puny-about-cve-2022-3602.html
|
||||
- https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
|
||||
- https://community.emergingthreats.net/t/out-of-band-ruleset-update-summary-2022-11-01/117
|
||||
- https://github.com/corelight/CVE-2022-3602/tree/master/scripts
|
||||
tags:
|
||||
analytic_story:
|
||||
- OpenSSL CVE-2022-3602
|
||||
asset_type: Network
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
confidence: 30
|
||||
context:
|
||||
- Source:IPS
|
||||
dataset: []
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
- Delivery
|
||||
message: A x509 certificate has been identified to have punycode in the SSL issuer email domain on $dest$.
|
||||
mitre_attack_id:
|
||||
- T1573
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- All_Certificates.SSL.ssl_issuer_email_domain
|
||||
- All_Certificates.SSL.ssl_issuer
|
||||
- All_Certificates.SSL.ssl_subject_email
|
||||
- All_Certificates.SSL.dest
|
||||
- All_Certificates.SSL.src
|
||||
- All_Certificates.SSL.sourcetype
|
||||
- All_Certificates.SSL.ssl_subject_email_domain
|
||||
risk_score: 15
|
||||
security_domain: network
|
||||
Reference in New Issue
Block a user