From d963b2a6bc3f3b4629cdfbdaa3e90adf55beddeb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 27 Aug 2021 11:54:37 -0400 Subject: [PATCH] adding 3 detections --- ...main_group_discovery_with_adsisearcher.yml | 50 +++++++++++++++++++ ...etadgroup_with_powershell_script_block.yml | 50 +++++++++++++++++++ ..._ds_group_with_powershell_script_block.yml | 50 +++++++++++++++++++ ...group_discovery_with_adsisearcher.test.yml | 12 +++++ ...roup_with_powershell_script_block.test.yml | 12 +++++ ...roup_with_powershell_script_block.test.yml | 12 +++++ 6 files changed, 186 insertions(+) create mode 100644 detections/endpoint/domain_group_discovery_with_adsisearcher.yml create mode 100644 detections/endpoint/getadgroup_with_powershell_script_block.yml create mode 100644 detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml create mode 100644 tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml create mode 100644 tests/endpoint/getadgroup_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml new file mode 100644 index 0000000000..9fa1f3abf9 --- /dev/null +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -0,0 +1,50 @@ +name: Domain Group Discovery with Adsisearcher +id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. + Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 60 + risk_score: 18 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml new file mode 100644 index 0000000000..d8cc186336 --- /dev/null +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -0,0 +1,50 @@ +name: GetAdGroup with PowerShell Script Block +id: e4c73d68-794b-468d-b4d0-dac1772bbae7 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. + Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml new file mode 100644 index 0000000000..f726fdf176 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -0,0 +1,50 @@ +name: GetWmiObject Ds Group with PowerShell Script Block +id: 67740bd3-1506-469c-b91d-effc322cc6e5 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. + Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml new file mode 100644 index 0000000000..1a7c735731 --- /dev/null +++ b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml @@ -0,0 +1,12 @@ +name: Domain Group Discovery with Adsisearcher Unit Test +tests: +- name: Domain Group Discovery with Adsisearcher + file: endpoint/domain_group_discovery_with_adsisearcher.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/getadgroup_with_powershell_script_block.test.yml b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..0a44e078a7 --- /dev/null +++ b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetAdGroup with PowerShell Script Block Unit Test +tests: +- name: GetAdGroup with PowerShell Script Block + file: endpoint/getadgroup_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..0e862eae33 --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject Ds Group with PowerShell Script Block Unit Test +tests: +- name: GetWmiObject Ds Group with PowerShell Script Block + file: endpoint/getwmiobject_ds_group_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file