From dac98c19b9e141cd7469c931c2b37fdefce759fd Mon Sep 17 00:00:00 2001 From: divious1 Date: Thu, 24 Sep 2020 18:05:10 -0400 Subject: [PATCH] skeleton --- ...l_dump_from_registry_via_reg_exe___ssa.yml | 50 ++ ...p_lsass.exe_memory_using_comsvcs___ssa.yml | 37 ++ detections/detect_phishing_content___ssa.yml | 47 ++ detections/first_time_seen_cmd_line___ssa.yml | 60 ++ ...ohibited_apps_spawning_cmdprompt___ssa.yml | 66 ++ ...ent_process_relationship_lolbas___ssa.yaml | 122 ++++ ...cess_running_unexpected_location___ssa.yml | 594 ++++++++++++++++++ ...l_lolbas_in_short_period_of_time___ssa.yml | 110 ++++ .../unusually_long_command_line___ssa.yml | 41 ++ ...ntial_dump_from_registry_via_reg_exe.ipynb | 208 ++++++ ..._dump_lsass.exe_memory_using_comsvcs.ipynb | 148 +++++ ...ain_and_publish_phishing_email_model.ipynb | 564 +++++++++++++++++ 12 files changed, 2047 insertions(+) create mode 100644 detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml create mode 100644 detections/detect_dump_lsass.exe_memory_using_comsvcs___ssa.yml create mode 100644 detections/detect_phishing_content___ssa.yml create mode 100644 detections/first_time_seen_cmd_line___ssa.yml create mode 100644 detections/prohibited_apps_spawning_cmdprompt___ssa.yml create mode 100644 detections/rare_parent_process_relationship_lolbas___ssa.yaml create mode 100644 detections/system_process_running_unexpected_location___ssa.yml create mode 100644 detections/unusual_lolbas_in_short_period_of_time___ssa.yml create mode 100644 detections/unusually_long_command_line___ssa.yml create mode 100644 notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb create mode 100644 notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb create mode 100644 notebooks/train_and_publish_phishing_email_model.ipynb diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml new file mode 100644 index 0000000000..f5851279e2 --- /dev/null +++ b/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml @@ -0,0 +1,50 @@ +name: Attempted Credential Dump From Registry via Reg exe +id: 14038953-e5f2-4daf-acff-5452062baf03 +version: 1 +date: '2020-6-04' +description: Monitor for execution of reg.exe with parameters specifying an export + of keys that contain hashed credentials that attackers may try to crack offline. +how_to_implement: You must be ingesting windows endpoint data that tracks process activity, + including parent-child relationships from your endpoints. +type: SSA +references: ['https://github.com/splunk/security-content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml'] +author: Jose Hernandez, Splunk +search: '| from $detection_source +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + +| eval process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + cmd_line=ucast(map_get(input_event, "process"), "string", null), + dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_ip_id=ucast(map_get(input_event, "dest_ip_id"), "string", null) +| where process_name="cmd.exe" OR process_name="reg.exe" +| where cmd_line LIKE "%save%" AND + (match_regex(cmd_line, /(?i)HKLM\\System/)=true OR + match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true + OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true + OR match_regex(cmd_line, /(?i)HKLM\\Security/)=true) + +| eval start_time = timestamp, +end_time = timestamp, +entities = mvappend(dest_ip_id, dest_user_id), +body = "TBD" +| into write_ssa_detected_events(); +' +known_false_positives: None identified. +tags: + analytics_story: + - Credential Dumping + mitre_attack_id: + - T1003 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + nist: + - DE.CM + security_domain: endpoint + asset_type: Endpoint + diff --git a/detections/detect_dump_lsass.exe_memory_using_comsvcs___ssa.yml b/detections/detect_dump_lsass.exe_memory_using_comsvcs___ssa.yml new file mode 100644 index 0000000000..196f4ee1f2 --- /dev/null +++ b/detections/detect_dump_lsass.exe_memory_using_comsvcs___ssa.yml @@ -0,0 +1,37 @@ +name: Detect Dump LSASS.exe Memory using comsvcs +id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e +version: 1 +date: '2020-09-15' +description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. +how_to_implement: You must be ingesting endpoint data that tracks process activity, including Windows command line logging. + You can see how we test this with [Event Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a) on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml). +type: SSA +references: ['https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf'] +author: Jose Hernandez, Splunk +search: ' +| from read_ssa_enriched_events() +| select from_json_object(value) as input_event +| eval tenant=ucast(map_get(input_event, "_tenant"), "string", null), +machine=ucast(map_get(input_event, "dest_ip_id"), "string", null), +process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), +timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), +process=lower(ucast(map_get(input_event, "process"), "string", null)) +| where process_name LIKE "%rundll32.exe%" +AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true +| into write_ssa_detected_events(); +' +known_false_positives: None identified. +tags: + analytics_story: + - Credential Dumping + mitre_attack_id: + - T1003.003 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + - CIS 16 + nist: + - DE.CM + security_domain: endpoint + asset_type: Endpoint diff --git a/detections/detect_phishing_content___ssa.yml b/detections/detect_phishing_content___ssa.yml new file mode 100644 index 0000000000..55e12c4975 --- /dev/null +++ b/detections/detect_phishing_content___ssa.yml @@ -0,0 +1,47 @@ +name: Phishing Email Detection by Machine Learning Method +id: 4b237388-dfa1-41a6-91d4-4de2d598376f +version: 1 +date: '2020-08-25' +description: Malicious mails can conduct phishing that induces readers to open attachment, + click links or trigger third party service. This detect uses Natural Language Processing (NLP) + approach to analyze an email message's content (Sender, Subject and Body) and judge whether + it is a phishing email. The detection adopts a deep learning (neural network) model that employs + character level embeddings plus LSTM layers to perform classification. The model is pre-trained + and then published as ONNX format. Current sample model is trained using the dataset published at + https://github.com/splunk/attack_data/tree/master/environments/phishing_email_dataset/ + User are expected to re-train the model by combining with their own training data for better + accuracy using the provided model file (SMLE notebook). DSP pipeline then processes the email + message and passes it as an event to Apply ML Models function, which returns the probability of a + phishing email. Current implementation assumes the email is fed to DSP in JSON format contains + at least email's sender, subject and its message body, including reply content, if any. +how_to_implement: Events are fed to DSP contains at least email's sender, subject and its + message body. +references: [ ] +type: SSA +author: Xiao Lin, Splunk +search: ' +| from read_splunk_firehose() +| source_type="email" +| eval strJsn=cast(body, "string"), jsonMap=from_json_object(strJsn), +eventLine=concat(ucast(map_get(jsonMap, "From"), "string", null), " ", ucast(map_get(jsonMap, "Subject"), "string", null), " ", ucast(map_get(jsonMap, "Content"), "string", null), " ") +eventLine=concat(ucast(map_get(jsonMap, "From"), "string", null), " ", ucast(map_get(jsonMap, "Subject"), "string", null), " ", ucast(map_get(jsonMap, "Content"), "string", null), " ", "1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678"), +mapC = {" ":32,"!":33,"\"":34,"#":35,"$":36,"%":37,"&":38,"`":39,"(":40,")":41,"*":42,"+":43,",":44,"-":45,".":46,"/":47,"0":48,"1":49,"2":50,"3":51,"4":52,"5":53,"6":54,"7":55,"8":56,"9":57,":":58,";":59,"<":60,"=":61,">":62,"?":63,"@":64,"A":65,"B":66,"C":67,"D":68,"E":69,"F":70,"G":71,"H":72,"I":73,"J":74,"K":75,"L":76,"M":77,"N":78,"O":79,"P":80,"Q":81,"R":82,"S":83,"T":84,"U":85,"V":86,"W":87,"X":88,"Y":89,"Z":90,"[":91,"\\":92,"]":93,"^":94,"_":95,"`":96,"a":97,"b":98,"c":99,"d":100,"e":101,"f":102,"g":103,"h":104,"i":105,"j":106,"k":107,"l":108,"m":109,"n":110,"o":111,"p":112,"q":113,"r":114,"s":115,"t":116,"u":117,"v":118,"w":119,"x":120,"y":121,"z":122,"{":123,"|":124,"}":125,"~":126}, +`embedding_input:0` = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i, 1)), "float") ) +| apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v2" path="s3://smle-experiments/models/phishing_email" +| where mvindex(`dense/Sigmoid:0`, 0) > 0.5 +| select body, host, timestamp, source_type, source, cast(mvindex(`dense/Sigmoid:0`, 0), "float") AS probability +| into into_splunk_enterprise("YOUR_SPLUNK_HEC_CONNECTOR_ID", "ssa", null); +' +known_false_positives: Because of imbalance of anomaly data in training, the model will less likely report false + positive. Instead, the model is more prone to false negative. Current best recall score is ~85% +tags: + kill_chain_phases: + - Actions on Objectives + mitre_technique_id: + - T1566 + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: mail server diff --git a/detections/first_time_seen_cmd_line___ssa.yml b/detections/first_time_seen_cmd_line___ssa.yml new file mode 100644 index 0000000000..7f460715b2 --- /dev/null +++ b/detections/first_time_seen_cmd_line___ssa.yml @@ -0,0 +1,60 @@ +name: First time seen command line argument +id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 +version: 1 +date: '2020-6-25' +description: "This search looks for command-line arguments that use a `/c` parameter + to execute a command that has not previously been seen. +This is an implementation on SPL2 of the rule `First time seen command line argument` by @bpatel." +how_to_implement: "You must be ingesting sysmon logs. +This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." +author: Ignacio Bermudez Corrales, Splunk +type: SSA +search: ' +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), + dest_ip_id=ucast(map_get(input_event, "dest_ip_id"), "string", null), + process_name=ucast(map_get(input_event, "process_name"), "string", null) + cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)) +| where process_name="cmd.exe" AND + match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true +| first_time_event cache_partitions=5 output_column="first_time_process_argument" input_columns="cmd_line" +| where first_time_process_argument +| eval start_time = timestamp, + end_time = timestamp, + entities = mvappend(dest_ip_id, dest_user_id), + body = "TBD" +| into write_ssa_detected_events(); + +' +eli5: "The subsearch returns all events where `cmd.exe` was used with a `/c` parameter + in the command-line arguments to execute other commands/programs. It appends the + historical data to those results in the lookup file. Next, it recalculates the `firstTime` + and `lastTime` field for command-line execution and outputs this data to the lookup + file to update the local cache. It returns only those events that have first been + seen in the past one hour. This is combined with the main search to return the time, + user, destination, process, parent process, and value of the command-line argument." +known_false_positives: "Legitimate programs can also use command-line arguments to + execute. Please verify the command-line arguments to check what command/program + is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name" +tags: + cis20: + - CIS 3 + - CIS 8 + kill_chain_phases: + - Command and Control + - Actions on Objectives + mitre_attack: + - Execution + - Scripting + - Persistence + - Command-Line Interface + mitre_technique_id: + - T1059 + - T1117 + - T1202 + nist: + - PR.PT + - DE.CM + - PR.IP +security_domain: endpoint diff --git a/detections/prohibited_apps_spawning_cmdprompt___ssa.yml b/detections/prohibited_apps_spawning_cmdprompt___ssa.yml new file mode 100644 index 0000000000..083311fb09 --- /dev/null +++ b/detections/prohibited_apps_spawning_cmdprompt___ssa.yml @@ -0,0 +1,66 @@ +name: Detect Prohibited Applications Spawning cmd exe +id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 +version: 1 +date: '2020-7-13' +description: "This search looks for executions of cmd.exe spawned by a process that +is often abused by attackers and that does not typically launch cmd.exe. +This is a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe` by @bpatel." +how_to_implement: "You must be ingesting sysmon logs. +This search has been modified to process raw sysmon data from attack_range's nxlogs on DSP." +author: Ignacio Bermudez Corrales, Splunk +type: SSA +search: ' +| from read_ssa_enriched_events() + +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval process_name=ucast(map_get(input_event, "process_name"), "string", null), +parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), +dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), +dest_ip_id=ucast(map_get(input_event, "dest_ip_id"), "string", null) + +| where process_name="cmd.exe" +| rex field=parent_process "(?[^\\\\]+)$" +| where field0="winword.exe" OR + field0="excel.exe" OR + field0="outlook.exe" OR + field0="powerpnt.exe" OR + field0="visio.exe" OR + field0="mspub.exe" OR + field0="acrobat.exe" OR + field0="acrord32.exe" OR + field0="chrome.exe" OR + field0="iexplore.exe" OR + field0="opera.exe" OR + field0="firefox.exe" OR + field0="java.exe" OR + field0="powershell.exe" + +| eval start_time=timestamp, +end_time=timestamp, +entities=mvappend([dest_ip_id, dest_user_id]), +body="TBD" +| into write_ssa_detected_events(); +' +eli5: "Obtaining access to the Command-Line Interface (CLI) is typically a primary + attacker goal. Once an attacker has obtained the ability to execute code on a target + system, they will often further manipulate the system via commands passed to the + CLI. It is also unusual for many applications to spawn a command shell during normal + operation, while it is often observed if an application has been compromised in + some way. As such, it is often beneficial to look for cmd.exe being executed by + processes that are often targeted for exploitation, or that would not spawn cmd.exe + in any other circumstances. A lookup file is provided to easily modify the processes + that are being watched for execution of cmd.exe." +known_false_positives: "There are circumstances where an application may legitimately + execute and interact with the Windows command-line interface. Investigate and modify + the lookup file, as appropriate." +tags: + cis20: + - CIS 8 + kill_chain_phases: + - Exploitation + mitre_technique_id: + - T1059 + nist: + - PR.PT + - DE.CM +security_domain: endpoint diff --git a/detections/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/rare_parent_process_relationship_lolbas___ssa.yaml new file mode 100644 index 0000000000..1c6b06a43e --- /dev/null +++ b/detections/rare_parent_process_relationship_lolbas___ssa.yaml @@ -0,0 +1,122 @@ +name: Rare Parent/Child Process Relationship +id: e03aa905-6549-4e34-b304-7a922185b2c4 +version: 1 +date: '2020-08-13' +description: An attacker may use LOLBAS tools spawned from vulnerable applications + not typically used by system administrators. + This search leverages the Splunk Streaming ML DSP plugin to find rare parent/child + relationships. + The list of application has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +references: [] +type: SSA +author: Ignacio Bermudez Corrales, Splunk +search: ' +| from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string", null)), +process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), +dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), +dest_ip_id=ucast(map_get(input_event, "dest_ip_id"), "string", null) + +| where parent_process!=null +| conditional_anomaly conditional="parent_process" target="process_name" +| rename output as input +| adaptive_threshold algorithm="quantile" entity="parent_process" value="input" window=604800000L +| where output AND quantile<0.1 AND (process_name="powershell.exe" OR + process_name="regsvcs.exe" OR + process_name="ftp.exe" OR + process_name="dfsvc.exe" OR + process_name="rasautou.exe" OR + process_name="schtasks.exe" OR + process_name="xwizard.exe" OR + process_name="findstr.exe" OR + process_name="esentutl.exe" OR + process_name="cscript.exe" OR + process_name="reg.exe" OR + process_name="csc.exe" OR + process_name="atbroker.exe" OR + process_name="print.exe" OR + process_name="pcwrun.exe" OR + process_name="vbc.exe" OR + process_name="rpcping.exe" OR + process_name="wsreset.exe" OR + process_name="ilasm.exe" OR + process_name="certutil.exe" OR + process_name="replace.exe" OR + process_name="mshta.exe" OR + process_name="bitsadmin.exe" OR + process_name="wscript.exe" OR + process_name="ieexec.exe" OR + process_name="cmd.exe" OR + process_name="microsoft.workflow.compiler.exe" OR + process_name="runscripthelper.exe" OR + process_name="makecab.exe" OR + process_name="forfiles.exe" OR + process_name="desktopimgdownldr.exe" OR + process_name="control.exe" OR + process_name="msbuild.exe" OR + process_name="register-cimprovider.exe" OR + process_name="tttracer.exe" OR + process_name="ie4uinit.exe" OR + process_name="sc.exe" OR + process_name="bash.exe" OR + process_name="hh.exe" OR + process_name="cmstp.exe" OR + process_name="mmc.exe" OR + process_name="jsc.exe" OR + process_name="scriptrunner.exe" OR + process_name="odbcconf.exe" OR + process_name="extexport.exe" OR + process_name="msdt.exe" OR + process_name="diskshadow.exe" OR + process_name="extrac32.exe" OR + process_name="eventvwr.exe" OR + process_name="mavinject.exe" OR + process_name="regasm.exe" OR + process_name="gpscript.exe" OR + process_name="rundll32.exe" OR + process_name="regsvr32.exe" OR + process_name="regedit.exe" OR + process_name="msiexec.exe" OR + process_name="gfxdownloadwrapper.exe" OR + process_name="presentationhost.exe" OR + process_name="regini.exe" OR + process_name="wmic.exe" OR + process_name="runonce.exe" OR + process_name="syncappvpublishingserver.exe" OR + process_name="verclsid.exe" OR + process_name="psr.exe" OR + process_name="infdefaultinstall.exe" OR + process_name="explorer.exe" OR + process_name="expand.exe" OR + process_name="installutil.exe" OR + process_name="netsh.exe" OR + process_name="wab.exe" OR + process_name="dnscmd.exe" OR + process_name="at.exe" OR + process_name="pcalua.exe" OR + process_name="cmdkey.exe" OR + process_name="msconfig.exe") + +| eval start_time = timestamp, +end_time = timestamp, +entities = mvappend(dest_ip_id, dest_user_id), +body = "TBD" +| into write_ssa_detected_events();' +known_false_positives: Some custom tools used by admins could be used rarely to launch remotely applications. +This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. +tags: + mitre_technique_id: + - T1203 + - T1059 + - T1053 + - T1072 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint diff --git a/detections/system_process_running_unexpected_location___ssa.yml b/detections/system_process_running_unexpected_location___ssa.yml new file mode 100644 index 0000000000..a4980814f4 --- /dev/null +++ b/detections/system_process_running_unexpected_location___ssa.yml @@ -0,0 +1,594 @@ +name: System Process Running from Unexpected Location +id: 28179107-099a-464a-94d3-08301e6c055f +version: 1 +date: '2020-08-25' +description: An attacker tries might try to use different version of a system command without overriding original, + or they might try to avoid some detection running the process from a different folder. + This detection checks that a list of system processes run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 + The list of system processes has been extracted from https://github.com/splunk/security-content/blob/develop/lookups/is_windows_system_file.csv + and the original detection https://github.com/splunk/security-content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +references: [] +type: SSA +author: Ignacio Bermudez Corrales, Splunk +search: ' | from read_ssa_enriched_events() + | eval device=ucast(map_get(input_event, "dest_ip_id"), "string", null), + process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), + process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)), + timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| where process_name="arp.exe" OR + process_name="adaptertroubleshooter.exe" OR + process_name="applicationframehost.exe" OR + process_name="atbroker.exe" OR + process_name="authhost.exe" OR + process_name="autoworkplace.exe" OR + process_name="axinstui.exe" OR + process_name="backgroundtransferhost.exe" OR + process_name="bdehdcfg.exe" OR + process_name="bdeuisrv.exe" OR + process_name="bdeunlockwizard.exe" OR + process_name="bitlockerdeviceencryption.exe" OR + process_name="bitlockerwizard.exe" OR + process_name="bitlockerwizardelev.exe" OR + process_name="bytecodegenerator.exe" OR + process_name="camerasettingsuihost.exe" OR + process_name="castsrv.exe" OR + process_name="certenrollctrl.exe" OR + process_name="checknetisolation.exe" OR + process_name="clipup.exe" OR + process_name="cloudexperiencehostbroker.exe" OR + process_name="cloudnotifications.exe" OR + process_name="cloudstoragewizard.exe" OR + process_name="compmgmtlauncher.exe" OR + process_name="compattelrunner.exe" OR + process_name="computerdefaults.exe" OR + process_name="credentialuibroker.exe" OR + process_name="dfdwiz.exe" OR + process_name="dwwin.exe" OR + process_name="dataexchangehost.exe" OR + process_name="defrag.exe" OR + process_name="devicedisplayobjectprovider.exe" OR + process_name="deviceeject.exe" OR + process_name="deviceenroller.exe" OR + process_name="devicepairingwizard.exe" OR + process_name="deviceproperties.exe" OR + process_name="disksnapshot.exe" OR + process_name="dism.exe" OR + process_name="displayswitch.exe" OR + process_name="dmnotificationbroker.exe" OR + process_name="dmomacpmo.exe" OR + process_name="dpiscaling.exe" OR + process_name="dsmusertask.exe" OR + process_name="dxpserver.exe" OR + process_name="edpcleanup.exe" OR + process_name="eosnotify.exe" OR + process_name="eap3host.exe" OR + process_name="easpoliciesbrokerhost.exe" OR + process_name="easeofaccessdialog.exe" OR + process_name="ehstorauthn.exe" OR + process_name="fxscover.exe" OR + process_name="fxssvc.exe" OR + process_name="fxsunatd.exe" OR + process_name="filehistory.exe" OR + process_name="fondue.exe" OR + process_name="gamepanel.exe" OR + process_name="genvalobj.exe" OR + process_name="gettingstarted.exe" OR + process_name="hostname.exe" OR + process_name="icsentitlementhost.exe" OR + process_name="infdefaultinstall.exe" OR + process_name="installagent.exe" OR + process_name="languagecomponentsinstallercomhandler.exe" OR + process_name="launchtm.exe" OR + process_name="launchwinapp.exe" OR + process_name="legacynetuxhost.exe" OR + process_name="licensemanagershellext.exe" OR + process_name="licensingui.exe" OR + process_name="locationnotificationwindows.exe" OR + process_name="locationnotifications.exe" OR + process_name="locator.exe" OR + process_name="lockapphost.exe" OR + process_name="lockscreencontentserver.exe" OR + process_name="logonui.exe" OR + process_name="lsaiso.exe" OR + process_name="mdeserver.exe" OR + process_name="mdmagent.exe" OR + process_name="mdmappinstaller.exe" OR + process_name="mrinfo.exe" OR + process_name="mrt.exe" OR + process_name="mschedexe.exe" OR + process_name="magnify.exe" OR + process_name="mbaeparsertask.exe" OR + process_name="mdres.exe" OR + process_name="mdsched.exe" OR + process_name="migautoplay.exe" OR + process_name="mpsigstub.exe" OR + process_name="msspellcheckinghost.exe" OR + process_name="muiunattend.exe" OR + process_name="multidigimon.exe" OR + process_name="musnotification.exe" OR + process_name="musnotificationux.exe" OR + process_name="napstat.exe" OR + process_name="netstat.exe" OR + process_name="narrator.exe" OR + process_name="netcfgnotifyobjecthost.exe" OR + process_name="netevtfwdr.exe" OR + process_name="netproj.exe" OR + process_name="netplwiz.exe" OR + process_name="networkuxbroker.exe" OR + process_name="openwith.exe" OR + process_name="optionalfeatures.exe" OR + process_name="pathping.exe" OR + process_name="ping.exe" OR + process_name="passwordonwakesettingflyout.exe" OR + process_name="pickerhost.exe" OR + process_name="pkgmgr.exe" OR + process_name="pnpunattend.exe" OR + process_name="pnputil.exe" OR + process_name="presentationhost.exe" OR + process_name="presentationsettings.exe" OR + process_name="printbrmui.exe" OR + process_name="printdialoghost.exe" OR + process_name="printdialoghost3d.exe" OR + process_name="printisolationhost.exe" OR + process_name="proximityuxhost.exe" OR + process_name="rdspnf.exe" OR + process_name="rmactivate.exe" OR + process_name="rmactivate_isv.exe" OR + process_name="rmactivate_ssp.exe" OR + process_name="rmactivate_ssp_isv.exe" OR + process_name="route.exe" OR + process_name="rdpsa.exe" OR + process_name="rdpsaproxy.exe" OR + process_name="rdpsauachelper.exe" OR + process_name="reagentc.exe" OR + process_name="recoverydrive.exe" OR + process_name="register-cimprovider.exe" OR + process_name="registeriepkeys.exe" OR + process_name="relpost.exe" OR + process_name="remoteposworker.exe" OR + process_name="rmclient.exe" OR + process_name="robocopy.exe" OR + process_name="rpcping.exe" OR + process_name="runlegacycplelevated.exe" OR + process_name="runtimebroker.exe" OR + process_name="sihclient.exe" OR + process_name="searchfilterhost.exe" OR + process_name="searchindexer.exe" OR + process_name="searchprotocolhost.exe" OR + process_name="secedit.exe" OR + process_name="sensordataservice.exe" OR + process_name="setieinstalleddate.exe" OR + process_name="settingsynchost.exe" OR + process_name="slidetoshutdown.exe" OR + process_name="smartscreensettings.exe" OR + process_name="sndvol.exe" OR + process_name="snippingtool.exe" OR + process_name="soundrecorder.exe" OR + process_name="spaceagent.exe" OR + process_name="sppextcomobj.exe" OR + process_name="srtasks.exe" OR + process_name="stikynot.exe" OR + process_name="synchost.exe" OR + process_name="sysreseterr.exe" OR + process_name="systempropertiesadvanced.exe" OR + process_name="systempropertiescomputername.exe" OR + process_name="systempropertiesdataexecutionprevention.exe" OR + process_name="systempropertieshardware.exe" OR + process_name="systempropertiesperformance.exe" OR + process_name="systempropertiesprotection.exe" OR + process_name="systempropertiesremote.exe" OR + process_name="systemsettingsadminflows.exe" OR + process_name="systemsettingsbroker.exe" OR + process_name="systemsettingsremovedevice.exe" OR + process_name="tcpsvcs.exe" OR + process_name="tracert.exe" OR + process_name="tstheme.exe" OR + process_name="tswbprxy.exe" OR + process_name="tapiunattend.exe" OR + process_name="taskmgr.exe" OR + process_name="thumbnailextractionhost.exe" OR + process_name="tokenbrokercookies.exe" OR + process_name="tpminit.exe" OR + process_name="tswpfwrp.exe" OR + process_name="ui0detect.exe" OR + process_name="upgraderesultsui.exe" OR + process_name="useraccountbroker.exe" OR + process_name="useraccountcontrolsettings.exe" OR + process_name="usoclient.exe" OR + process_name="utilman.exe" OR + process_name="vssvc.exe" OR + process_name="vaultcmd.exe" OR + process_name="vaultsysui.exe" OR + process_name="wfs.exe" OR + process_name="wmpdmc.exe" OR + process_name="wpdshextautoplay.exe" OR + process_name="wscollect.exe" OR + process_name="wsmanhttpconfig.exe" OR + process_name="wsreset.exe" OR + process_name="wudfhost.exe" OR + process_name="wwahost.exe" OR + process_name="wallpaperhost.exe" OR + process_name="webcache.exe" OR + process_name="werfault.exe" OR + process_name="werfaultsecure.exe" OR + process_name="winsat.exe" OR + process_name="windows.media.backgroundplayback.exe" OR + process_name="windowsactiondialog.exe" OR + process_name="windowsanytimeupgrade.exe" OR + process_name="windowsanytimeupgraderesults.exe" OR + process_name="windowsanytimeupgradeui.exe" OR + process_name="windowsupdateelevatedinstaller.exe" OR + process_name="workfolders.exe" OR + process_name="wpcmon.exe" OR + process_name="acu.exe" OR + process_name="aitagent.exe" OR + process_name="aitstatic.exe" OR + process_name="alg.exe" OR + process_name="appidcertstorecheck.exe" OR + process_name="appidpolicyconverter.exe" OR + process_name="at.exe" OR + process_name="attrib.exe" OR + process_name="audiodg.exe" OR + process_name="auditpol.exe" OR + process_name="autochk.exe" OR + process_name="autoconv.exe" OR + process_name="autofmt.exe" OR + process_name="baaupdate.exe" OR + process_name="backgroundtaskhost.exe" OR + process_name="bcastdvr.exe" OR + process_name="bcdboot.exe" OR + process_name="bcdedit.exe" OR + process_name="bdechangepin.exe" OR + process_name="bdeunlock.exe" OR + process_name="bitsadmin.exe" OR + process_name="bootcfg.exe" OR + process_name="bootim.exe" OR + process_name="bootsect.exe" OR + process_name="bridgeunattend.exe" OR + process_name="browser_broker.exe" OR + process_name="bthudtask.exe" OR + process_name="cacls.exe" OR + process_name="calc.exe" OR + process_name="cdpreference.exe" OR + process_name="certreq.exe" OR + process_name="certutil.exe" OR + process_name="change.exe" OR + process_name="changepk.exe" OR + process_name="charmap.exe" OR + process_name="chglogon.exe" OR + process_name="chgport.exe" OR + process_name="chgusr.exe" OR + process_name="chkdsk.exe" OR + process_name="chkntfs.exe" OR + process_name="choice.exe" OR + process_name="cipher.exe" OR + process_name="cleanmgr.exe" OR + process_name="cliconfg.exe" OR + process_name="clip.exe" OR + process_name="cmd.exe" OR + process_name="cmdkey.exe" OR + process_name="cmdl32.exe" OR + process_name="cmmon32.exe" OR + process_name="cmstp.exe" OR + process_name="cofire.exe" OR + process_name="colorcpl.exe" OR + process_name="comp.exe" OR + process_name="compact.exe" OR + process_name="conhost.exe" OR + process_name="consent.exe" OR + process_name="control.exe" OR + process_name="convert.exe" OR + process_name="credwiz.exe" OR + process_name="cscript.exe" OR + process_name="csrss.exe" OR + process_name="ctfmon.exe" OR + process_name="cttune.exe" OR + process_name="cttunesvr.exe" OR + process_name="dashost.exe" OR + process_name="dccw.exe" OR + process_name="dcomcnfg.exe" OR + process_name="ddodiag.exe" OR + process_name="dfrgui.exe" OR + process_name="dialer.exe" OR + process_name="diantz.exe" OR + process_name="dinotify.exe" OR + process_name="diskpart.exe" OR + process_name="diskperf.exe" OR + process_name="diskraid.exe" OR + process_name="dispdiag.exe" OR + process_name="djoin.exe" OR + process_name="dllhost.exe" OR + process_name="dllhst3g.exe" OR + process_name="dmcertinst.exe" OR + process_name="dmcfghost.exe" OR + process_name="dmclient.exe" OR + process_name="dnscacheugc.exe" OR + process_name="doskey.exe" OR + process_name="dpapimig.exe" OR + process_name="dpnsvr.exe" OR + process_name="driverquery.exe" OR + process_name="drvcfg.exe" OR + process_name="drvinst.exe" OR + process_name="dsregcmd.exe" OR + process_name="dstokenclean.exe" OR + process_name="dvdplay.exe" OR + process_name="dvdupgrd.exe" OR + process_name="dwm.exe" OR + process_name="dxdiag.exe" OR + process_name="easinvoker.exe" OR + process_name="efsui.exe" OR + process_name="embeddedapplauncher.exe" OR + process_name="esentutl.exe" OR + process_name="eudcedit.exe" OR + process_name="eventcreate.exe" OR + process_name="eventvwr.exe" OR + process_name="expand.exe" OR + process_name="extrac32.exe" OR + process_name="fc.exe" OR + process_name="fhmanagew.exe" OR + process_name="find.exe" OR + process_name="findstr.exe" OR + process_name="finger.exe" OR + process_name="fixmapi.exe" OR + process_name="fltmc.exe" OR + process_name="fodhelper.exe" OR + process_name="fontdrvhost.exe" OR + process_name="fontview.exe" OR + process_name="forfiles.exe" OR + process_name="fsavailux.exe" OR + process_name="fsquirt.exe" OR + process_name="fsutil.exe" OR + process_name="ftp.exe" OR + process_name="fvenotify.exe" OR + process_name="fveprompt.exe" OR + process_name="getmac.exe" OR + process_name="gpresult.exe" OR + process_name="gpscript.exe" OR + process_name="gpupdate.exe" OR + process_name="grpconv.exe" OR + process_name="hdwwiz.exe" OR + process_name="help.exe" OR + process_name="hwrcomp.exe" OR + process_name="hwrreg.exe" OR + process_name="icacls.exe" OR + process_name="icardagt.exe" OR + process_name="icsunattend.exe" OR + process_name="ie4uinit.exe" OR + process_name="ieunatt.exe" OR + process_name="ieetwcollector.exe" OR + process_name="iexpress.exe" OR + process_name="immersivetpmvscmgrsvr.exe" OR + process_name="ipconfig.exe" OR + process_name="irftp.exe" OR + process_name="iscsicli.exe" OR + process_name="iscsicpl.exe" OR + process_name="isoburn.exe" OR + process_name="klist.exe" OR + process_name="ksetup.exe" OR + process_name="ktmutil.exe" OR + process_name="label.exe" OR + process_name="licensingdiag.exe" OR + process_name="lodctr.exe" OR + process_name="logagent.exe" OR + process_name="logman.exe" OR + process_name="logoff.exe" OR + process_name="lpkinstall.exe" OR + process_name="lpksetup.exe" OR + process_name="lpremove.exe" OR + process_name="lsass.exe" OR + process_name="lsm.exe" OR + process_name="makecab.exe" OR + process_name="manage-bde.exe" OR + process_name="mblctr.exe" OR + process_name="mcbuilder.exe" OR + process_name="mctadmin.exe" OR + process_name="mfpmp.exe" OR + process_name="mmc.exe" OR + process_name="mobsync.exe" OR + process_name="mountvol.exe" OR + process_name="mpnotify.exe" OR + process_name="msconfig.exe" OR + process_name="msdt.exe" OR + process_name="msdtc.exe" OR + process_name="msfeedssync.exe" OR + process_name="msg.exe" OR + process_name="mshta.exe" OR + process_name="msiexec.exe" OR + process_name="msinfo32.exe" OR + process_name="mspaint.exe" OR + process_name="msra.exe" OR + process_name="mstsc.exe" OR + process_name="mtstocom.exe" OR + process_name="nbtstat.exe" OR + process_name="ndadmin.exe" OR + process_name="net.exe" OR + process_name="net1.exe" OR + process_name="netbtugc.exe" OR + process_name="netcfg.exe" OR + process_name="netiougc.exe" OR + process_name="netsh.exe" OR + process_name="newdev.exe" OR + process_name="nltest.exe" OR + process_name="notepad.exe" OR + process_name="nslookup.exe" OR + process_name="ntoskrnl.exe" OR + process_name="ntprint.exe" OR + process_name="ocsetup.exe" OR + process_name="odbcad32.exe" OR + process_name="odbcconf.exe" OR + process_name="omadmclient.exe" OR + process_name="omadmprc.exe" OR + process_name="openfiles.exe" OR + process_name="osk.exe" OR + process_name="p2phost.exe" OR + process_name="pcalua.exe" OR + process_name="pcaui.exe" OR + process_name="pcawrk.exe" OR + process_name="pcwrun.exe" OR + process_name="perfmon.exe" OR + process_name="phoneactivate.exe" OR + process_name="plasrv.exe" OR + process_name="poqexec.exe" OR + process_name="powercfg.exe" OR + process_name="prevhost.exe" OR + process_name="print.exe" OR + process_name="printfilterpipelinesvc.exe" OR + process_name="printui.exe" OR + process_name="proquota.exe" OR + process_name="provtool.exe" OR + process_name="psr.exe" OR + process_name="pwlauncher.exe" OR + process_name="qappsrv.exe" OR + process_name="qprocess.exe" OR + process_name="query.exe" OR + process_name="quser.exe" OR + process_name="qwinsta.exe" OR + process_name="rasautou.exe" OR + process_name="rasdial.exe" OR + process_name="raserver.exe" OR + process_name="rasphone.exe" OR + process_name="rdpclip.exe" OR + process_name="rdpinput.exe" OR + process_name="rdrleakdiag.exe" OR + process_name="recdisc.exe" OR + process_name="recover.exe" OR + process_name="reg.exe" OR + process_name="regedt32.exe" OR + process_name="regini.exe" OR + process_name="regsvr32.exe" OR + process_name="rekeywiz.exe" OR + process_name="relog.exe" OR + process_name="repair-bde.exe" OR + process_name="replace.exe" OR + process_name="reset.exe" OR + process_name="resmon.exe" OR + process_name="rmttpmvscmgrsvr.exe" OR + process_name="rrinstaller.exe" OR + process_name="rstrui.exe" OR + process_name="runas.exe" OR + process_name="rundll32.exe" OR + process_name="runonce.exe" OR + process_name="rwinsta.exe" OR + process_name="sbunattend.exe" OR + process_name="sc.exe" OR + process_name="schtasks.exe" OR + process_name="sdbinst.exe" OR + process_name="sdchange.exe" OR + process_name="sdclt.exe" OR + process_name="sdiagnhost.exe" OR + process_name="secinit.exe" OR + process_name="services.exe" OR + process_name="sessionmsg.exe" OR + process_name="sethc.exe" OR + process_name="setspn.exe" OR + process_name="setupcl.exe" OR + process_name="setupugc.exe" OR + process_name="setx.exe" OR + process_name="sfc.exe" OR + process_name="shadow.exe" OR + process_name="shrpubw.exe" OR + process_name="shutdown.exe" OR + process_name="sigverif.exe" OR + process_name="sihost.exe" OR + process_name="slui.exe" OR + process_name="smss.exe" OR + process_name="snmptrap.exe" OR + process_name="sort.exe" OR + process_name="spinstall.exe" OR + process_name="spoolsv.exe" OR + process_name="sppsvc.exe" OR + process_name="spreview.exe" OR + process_name="srdelayed.exe" OR + process_name="subst.exe" OR + process_name="svchost.exe" OR + process_name="sxstrace.exe" OR + process_name="syskey.exe" OR + process_name="systeminfo.exe" OR + process_name="systemreset.exe" OR + process_name="systray.exe" OR + process_name="tabcal.exe" OR + process_name="takeown.exe" OR + process_name="taskeng.exe" OR + process_name="taskhost.exe" OR + process_name="taskhostw.exe" OR + process_name="taskkill.exe" OR + process_name="tasklist.exe" OR + process_name="taskmgr.exe" OR + process_name="tcmsetup.exe" OR + process_name="timeout.exe" OR + process_name="tpmvscmgr.exe" OR + process_name="tpmvscmgrsvr.exe" OR + process_name="tracerpt.exe" OR + process_name="tscon.exe" OR + process_name="tsdiscon.exe" OR + process_name="tskill.exe" OR + process_name="typeperf.exe" OR + process_name="tzsync.exe" OR + process_name="tzutil.exe" OR + process_name="ucsvc.exe" OR + process_name="unlodctr.exe" OR + process_name="unregmp2.exe" OR + process_name="upnpcont.exe" OR + process_name="userinit.exe" OR + process_name="vds.exe" OR + process_name="vdsldr.exe" OR + process_name="verclsid.exe" OR + process_name="verifier.exe" OR + process_name="verifiergui.exe" OR + process_name="vmicsvc.exe" OR + process_name="vssadmin.exe" OR + process_name="w32tm.exe" OR + process_name="waitfor.exe" OR + process_name="wbadmin.exe" OR + process_name="wbengine.exe" OR + process_name="wecutil.exe" OR + process_name="wermgr.exe" OR + process_name="wevtutil.exe" OR + process_name="wextract.exe" OR + process_name="where.exe" OR + process_name="whoami.exe" OR + process_name="wiaacmgr.exe" OR + process_name="wiawow64.exe" OR + process_name="wifitask.exe" OR + process_name="wimserv.exe" OR + process_name="wininit.exe" OR + process_name="winload.exe" OR + process_name="winlogon.exe" OR + process_name="winresume.exe" OR + process_name="winrs.exe" OR + process_name="winrshost.exe" OR + process_name="winver.exe" OR + process_name="wisptis.exe" OR + process_name="wkspbroker.exe" OR + process_name="wksprt.exe" OR + process_name="wlanext.exe" OR + process_name="wlrmdr.exe" OR + process_name="wowreg32.exe" OR + process_name="wpnpinst.exe" OR + process_name="wpr.exe" OR + process_name="write.exe" OR + process_name="wscript.exe" OR + process_name="wsmprovhost.exe" OR + process_name="wsqmcons.exe" OR + process_name="wuapihost.exe" OR + process_name="wuapp.exe" OR + process_name="wuauclt.exe" OR + process_name="wusa.exe" OR + process_name="xcopy.exe" OR + process_name="xpsrchvw.exe" OR + process_name="xwizard.exe" + | where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64" + | into write_ssa_detected_events();' +known_false_positives: None +tags: + mitre_technique_id: + - T1036 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint diff --git a/detections/unusual_lolbas_in_short_period_of_time___ssa.yml b/detections/unusual_lolbas_in_short_period_of_time___ssa.yml new file mode 100644 index 0000000000..6821f84afa --- /dev/null +++ b/detections/unusual_lolbas_in_short_period_of_time___ssa.yml @@ -0,0 +1,110 @@ +name: More than usual number of LOLBAS applications in short time period +id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 +version: 1 +date: '2020-08-25' +description: + Attacker activity may compromise executing several LOLBAS applications in conjunction + to accomplish their objectives. We are looking for more than usual LOLBAS applications + over a window of time, by building profiles per machine. +how_to_implement: Collect endpoint data such as sysmon or 4688 events. +references: [https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries] +type: SSA +author: Ignacio Bermudez Corrales, Splunk +search: ' | from read_ssa_enriched_events() +| eval device=ucast(map_get(input_event, "dest_ip_id"), "string", null), +process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), +timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| where process_name=="regsvcs.exe" OR + process_name=="ftp.exe" OR + process_name=="dfsvc.exe" OR + process_name=="rasautou.exe" OR + process_name=="schtasks.exe" OR + process_name=="xwizard.exe" OR + process_name=="findstr.exe" OR + process_name=="esentutl.exe" OR + process_name=="cscript.exe" OR + process_name=="reg.exe" OR + process_name=="csc.exe" OR + process_name=="atbroker.exe" OR + process_name=="print.exe" OR + process_name=="pcwrun.exe" OR + process_name=="vbc.exe" OR + process_name=="rpcping.exe" OR + process_name=="wsreset.exe" OR + process_name=="ilasm.exe" OR + process_name=="certutil.exe" OR + process_name=="replace.exe" OR + process_name=="mshta.exe" OR + process_name=="bitsadmin.exe" OR + process_name=="wscript.exe" OR + process_name=="ieexec.exe" OR + process_name=="cmd.exe" OR + process_name=="microsoft.workflow.compiler.exe" OR + process_name=="runscripthelper.exe" OR + process_name=="makecab.exe" OR + process_name=="forfiles.exe" OR + process_name=="desktopimgdownldr.exe" OR + process_name=="control.exe" OR + process_name=="msbuild.exe" OR + process_name=="register-cimprovider.exe" OR + process_name=="tttracer.exe" OR + process_name=="ie4uinit.exe" OR + process_name=="sc.exe" OR + process_name=="bash.exe" OR + process_name=="hh.exe" OR + process_name=="cmstp.exe" OR + process_name=="mmc.exe" OR + process_name=="jsc.exe" OR + process_name=="scriptrunner.exe" OR + process_name=="odbcconf.exe" OR + process_name=="extexport.exe" OR + process_name=="msdt.exe" OR + process_name=="diskshadow.exe" OR + process_name=="extrac32.exe" OR + process_name=="eventvwr.exe" OR + process_name=="mavinject.exe" OR + process_name=="regasm.exe" OR + process_name=="gpscript.exe" OR + process_name=="rundll32.exe" OR + process_name=="regsvr32.exe" OR + process_name=="regedit.exe" OR + process_name=="msiexec.exe" OR + process_name=="gfxdownloadwrapper.exe" OR + process_name=="presentationhost.exe" OR + process_name=="regini.exe" OR + process_name=="wmic.exe" OR + process_name=="runonce.exe" OR + process_name=="syncappvpublishingserver.exe" OR + process_name=="verclsid.exe" OR + process_name=="psr.exe" OR + process_name=="infdefaultinstall.exe" OR + process_name=="explorer.exe" OR + process_name=="expand.exe" OR + process_name=="installutil.exe" OR + process_name=="netsh.exe" OR + process_name=="wab.exe" OR + process_name=="dnscmd.exe" OR + process_name=="at.exe" OR + process_name=="pcalua.exe" OR + process_name=="cmdkey.exe" OR + process_name=="msconfig.exe" +| stats count(process_name) as lolbas_counter by device,span(timestamp, 300s) +| eval lolbas_counter=lolbas_counter*1.0 +| adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000 +| where output AND quantile>0.5 +| into write_ssa_detected_events();' +known_false_positives: > + Some administrative tasks may involve multiple use of LOLBAS applications in a short period of time. + This might trigger false positives at the beginning when it hasn't collected yet enough data to construct the baseline. +tags: + mitre_technique_id: + - T1059 + - T1053 + kill_chain_phases: + - Exploitation + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint diff --git a/detections/unusually_long_command_line___ssa.yml b/detections/unusually_long_command_line___ssa.yml new file mode 100644 index 0000000000..57958f9efd --- /dev/null +++ b/detections/unusually_long_command_line___ssa.yml @@ -0,0 +1,41 @@ +name: Unusually Long Command Line +id: 58f43aba-1775-445e-b19c-be2b87d83ae3 +version: 1 +date: '2020-07-23' +description: Command lines that are extremely long may be indicative of malicious + activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin + to help identify command lines with lengths that are unusual for a given user. + This detection is inspired on Unusually Long Command Line authored by Rico Valdez. +how_to_implement: You must be ingesting sysmon endpoint data that monitors command lines. +references: [] +type: SSA +author: Rico Valdez, Ignacio Bermudez Corrales, Splunk +search: ' | from read_ssa_enriched_events() +| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) +| eval cmd_line=ucast(map_get(input_event, "process"), "string", null), +dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null), +input=parse_double(len(coalesce(cmd_line, ""))), +dest_ip_id=ucast(map_get(input_event, "dest_ip_id"), "string", null) +| where cmd_line!=null and dest_user_id!=null +| adaptive_threshold algorithm="quantile" entity="dest_user_id" window=60480000 +| where output="True" AND quantile>0.99 +| eval start_time = timestamp, +end_time = timestamp, +entities = mvappend(dest_ip_id, dest_user_id), +body = "TBD" +| into write_ssa_detected_events(); +' +known_false_positives: Some legitimate applications use long command lines for installs + or updates. You should review identified command lines for legitimacy. + At the beginning of this search `adaptive_threshold` needs time to learn the baseline. + This search runs on a window of one week, if pattern of command line length changes over time, + some previously non suspiciously long commands can be suspicious in the current context. +tags: + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 8 + nist: + - PR.PT + - DE.CM + security_domain: endpoint diff --git a/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb b/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb new file mode 100644 index 0000000000..7c00a092c8 --- /dev/null +++ b/notebooks/attempted_credential_dump_from_registry_via_reg_exe.ipynb @@ -0,0 +1,208 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Detect Credential Dumping via reg.exe T1003.002" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. MITRE ATT&CK" + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "metadata": { + "scrolled": true + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "52673b085061486eb1498c6c18619c93", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "85d46b6b600f49ae812705671ef9d259", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "Grid(columns_fit='size_to_fit', compress_data=True, export_mode='disabled', height='350px', menu={'buttons': […" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 1, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "%%spl2 -o aggrid\n", + "/* read attack dataset generated by Splunk Attack Range */\n", + "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.002/attack_data.txt\")\n", + "/* cast data as JSON */\n", + "| eval sysmon=from_json_object(cast(value, \"string\"))\n", + "/* read in the process name */\n", + "| eval process_name=ucast(map_get(sysmon, \"Image\"), \"string\", \"\") \n", + "/* filter on cmd.exe and reg.exe */\n", + "| where process_name LIKE \"%cmd.exe%\" OR process_name=\"%reg.exe%\"\n", + "/* read in the process name */\n", + "| eval cmd_line=ucast(map_get(sysmon, \"CommandLine\"), \"string\", \"\") \n", + "/* filter by any command line string that has the word save and matches targetted registry */\n", + "| where cmd_line LIKE \"%save%\" \n", + "AND (match_regex(cmd_line, /(?i)HKLM\\\\System/)=true \n", + "OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\Security/)=true \n", + "OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\\\SAM/)=true \n", + "OR match_regex(cmd_line, /(?i)HKLM\\\\SAM/)=true \n", + "OR match_regex(cmd_line, /(?i)HKLM\\\\Security/)=true);" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "# Now lets try a ML detection " + ] + }, + { + "cell_type": "code", + "execution_count": 2, + "metadata": {}, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "2af185b53fc843a0a670d3bce6df6a90", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "0fd7cb9bfce743caaacbbcb294ad138c", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "Grid(columns_fit='size_to_fit', compress_data=True, export_mode='disabled', height='350px', menu={'buttons': […" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 2, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "%%spl2 -o aggrid\n", + "/* read attack dataset generated by Splunk Attack Range */\n", + "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.002/attack_data.txt\")\n", + "/* cast data as JSON */\n", + "| eval sysmon=from_json_object(cast(value, \"string\"))\n", + "/* read in the different fields, time, process and command line */\n", + "| eval timestamp=parse_long(ucast(map_get(sysmon, \"EventTime\"), \"string\", null))\n", + "| eval process_name=ucast(map_get(sysmon, \"Image\"), \"string\", \"\")\n", + "| eval cmd_line=ucast(map_get(sysmon, \"CommandLine\"), \"string\", \"\") \n", + "/* match on cmd.exe and extract the args */\n", + "| where process_name LIKE \"%cmd.exe%\" \n", + "and match_regex(ucast(cmd_line, \"string\", \"\"), /.* \\/[cC] .*/)=true\n", + "/* use first_time_event algorithm to determin the first time seen args */\n", + "| first_time_event cache_partitions=5 input_columns=\"cmd_line\"\n", + "/* filter by the that were seen for the first time */\n", + "| where 'first_time-cmd_line';\n", + "\n" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": { + "jupyter": { + "source_hidden": true + } + }, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb b/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb new file mode 100644 index 0000000000..ef5b3d28fa --- /dev/null +++ b/notebooks/detect_dump_lsass.exe_memory_using_comsvcs.ipynb @@ -0,0 +1,148 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": { + "execution": { + "iopub.execute_input": "2020-09-24T04:06:52.928068Z", + "iopub.status.busy": "2020-09-24T04:06:52.927779Z", + "iopub.status.idle": "2020-09-24T04:06:52.934766Z", + "shell.execute_reply": "2020-09-24T04:06:52.934058Z", + "shell.execute_reply.started": "2020-09-24T04:06:52.928046Z" + } + }, + "source": [ + "# Detect Dump LSASS.exe Memory using comsvcs\n", + "\n", + "#### This search detects the memory of lsass.exe being dumped for offline credential theft attack.\n", + "\n", + "References: https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf\n", + "\n", + "Author: Jose Hernandez, Splunk\n", + "\n", + "Known false positives: None identified.\n", + "\n", + "Tags: Credential Dumping, T1003.003, Actions on Objectives, CIS 8, CIS 16\n", + "\n", + "Source: https://github.com/splunk/security-content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml" + ] + }, + { + "cell_type": "code", + "execution_count": 4, + "metadata": { + "execution": { + "iopub.execute_input": "2020-09-24T04:07:48.041438Z", + "iopub.status.busy": "2020-09-24T04:07:48.041158Z", + "iopub.status.idle": "2020-09-24T04:07:51.246791Z", + "shell.execute_reply": "2020-09-24T04:07:51.246203Z", + "shell.execute_reply.started": "2020-09-24T04:07:48.041415Z" + } + }, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "64caa06c26da4d418fbfaba13d7b9741", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "69a731af7f5f455f91e0302a57dffe23", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "Grid(columns_fit='size_to_fit', compress_data=True, export_mode='disabled', height='350px', menu={'buttons': […" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + "\n" + ] + }, + { + "data": { + "text/plain": [ + "" + ] + }, + "execution_count": 4, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "%%spl2 -o aggrid\n", + "| from read_text(\"s3://smle-experiments/datasets/attack-range/T1003.001/windows-security-events_ssa.log\")\n", + "| select from_json_object(value) as input_event\n", + "| eval tenant=ucast(map_get(input_event, \"_tenant\"), \"string\", null),\n", + "machine=ucast(map_get(input_event, \"dest_ip_id\"), \"string\", null),\n", + "process_name=lower(ucast(map_get(input_event, \"process_name\"), \"string\", null)),\n", + "timestamp=parse_long(ucast(map_get(input_event, \"_time\"), \"string\", null)),\n", + "process=lower(ucast(map_get(input_event, \"process\"), \"string\", null))\n", + "| where process_name LIKE \"%rundll32.exe%\"\n", + "AND match_regex(process, /(?i)comsvcs.dll MiniDump/)=true;" + ] + }, + { + "cell_type": "markdown", + "metadata": { + "execution": { + "iopub.execute_input": "2020-09-24T04:07:41.132723Z", + "iopub.status.busy": "2020-09-24T04:07:41.132299Z", + "iopub.status.idle": "2020-09-24T04:07:41.142005Z", + "shell.execute_reply": "2020-09-24T04:07:41.141000Z", + "shell.execute_reply.started": "2020-09-24T04:07:41.132683Z" + } + }, + "source": [ + "# Dataset \n", + "This data set way generated via launching [atomic red team](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/) technique ID: T1003.01 and results were captured by the [Splunk Attack Range](https://github.com/splunk/attack_range).\n", + "This detection specifically address [atomic](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll)\n", + "Source: https://github.com/splunk/attack_data/blob/master/datasets/T1003.001/dataset.yml" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "SPL2", + "language": "SPL", + "name": "spl2" + }, + "language_info": { + "mimetype": "text/spl", + "name": "SPL" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +} diff --git a/notebooks/train_and_publish_phishing_email_model.ipynb b/notebooks/train_and_publish_phishing_email_model.ipynb new file mode 100644 index 0000000000..b78a41adf2 --- /dev/null +++ b/notebooks/train_and_publish_phishing_email_model.ipynb @@ -0,0 +1,564 @@ +{ + "cells": [ + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Train Model" + ] + }, + { + "cell_type": "code", + "execution_count": 1, + "metadata": {}, + "outputs": [], + "source": [ + "import numpy as np\n", + "import pandas as pd\n", + "\n", + "from tensorflow.keras.layers import Dense, Embedding, LSTM, SpatialDropout1D\n", + "from tensorflow.keras.models import Sequential\n", + "from tensorflow.keras.callbacks import EarlyStopping\n", + "from tensorflow.keras import metrics" + ] + }, + { + "cell_type": "code", + "execution_count": 2, + "metadata": {}, + "outputs": [], + "source": [ + "maxLen = 128\n", + "epochs = 50\n", + "dim_embedding = 50\n", + "batch_size = 256\n", + "dropout_rate = 0.25\n", + "num_LSTM_cell = 64\n", + "trainDataFileName = 's3://smle-experiments/datasets/phishing_email/train.json'" + ] + }, + { + "cell_type": "code", + "execution_count": 3, + "metadata": {}, + "outputs": [], + "source": [ + "xTrain = []\n", + "yTrain = []\n", + "df = pd.read_json(trainDataFileName, lines = True)\n", + "for idx, row in df.iterrows():\n", + " label = np.zeros(1)\n", + " if row['isPhishing'] == 'True':\n", + " label[0] = 1\n", + " yTrain.append(label)\n", + " aMessage = row['From'] + ' ' + row['Subject'] + ' ' + row['Content']\n", + " anEvent = np.array([32]*maxLen)\n", + " p = 0\n", + " for c in aMessage:\n", + " v = ord(c)\n", + " if v < 32 or v > 126:\n", + " continue\n", + " anEvent[p] = v\n", + " p += 1\n", + " if p >= maxLen:\n", + " break\n", + " xTrain.append(anEvent)\n", + "xTrain = np.array(xTrain)\n", + "yTrain = np.array(yTrain)" + ] + }, + { + "cell_type": "code", + "execution_count": 4, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/keras/initializers.py:119: calling RandomUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Call initializer instance with the dtype argument instead of passing it to the constructor\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/resource_variable_ops.py:1630: calling BaseResourceVariable.__init__ (from tensorflow.python.ops.resource_variable_ops) with constraint is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "If using Keras pass *_constraint arguments to layers.\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/nn_impl.py:183: where (from tensorflow.python.ops.array_ops) is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Use tf.where in 2.0, which has the same broadcast rule as np.where\n", + "Train on 40000 samples, validate on 10000 samples\n", + "Epoch 1/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.1514 - acc: 0.9740 - val_loss: 0.0912 - val_acc: 0.9817\n", + "Epoch 2/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0990 - acc: 0.9796 - val_loss: 0.0904 - val_acc: 0.9817\n", + "Epoch 3/50\n", + "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0884 - acc: 0.9796 - val_loss: 0.0726 - val_acc: 0.9828\n", + "Epoch 4/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0726 - acc: 0.9798 - val_loss: 0.0640 - val_acc: 0.9830\n", + "Epoch 5/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0667 - acc: 0.9812 - val_loss: 0.0621 - val_acc: 0.9855\n", + "Epoch 6/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0665 - acc: 0.9813 - val_loss: 0.0598 - val_acc: 0.9849\n", + "Epoch 7/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0651 - acc: 0.9816 - val_loss: 0.0529 - val_acc: 0.9824\n", + "Epoch 8/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0532 - acc: 0.9830 - val_loss: 0.0393 - val_acc: 0.9889\n", + "Epoch 9/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0474 - acc: 0.9844 - val_loss: 0.0428 - val_acc: 0.9891\n", + "Epoch 10/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0419 - acc: 0.9891 - val_loss: 0.0359 - val_acc: 0.9912\n", + "Epoch 11/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0385 - acc: 0.9886 - val_loss: 0.0271 - val_acc: 0.9922\n", + "Epoch 12/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0369 - acc: 0.9894 - val_loss: 0.0251 - val_acc: 0.9937\n", + "Epoch 13/50\n", + "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0299 - acc: 0.9921 - val_loss: 0.0255 - val_acc: 0.9933\n", + "Epoch 14/50\n", + "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0242 - acc: 0.9942 - val_loss: 0.0181 - val_acc: 0.9948\n", + "Epoch 15/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0210 - acc: 0.9958 - val_loss: 0.0195 - val_acc: 0.9957\n", + "Epoch 16/50\n", + "40000/40000 [==============================] - 44s 1ms/sample - loss: 0.0179 - acc: 0.9961 - val_loss: 0.0146 - val_acc: 0.9965\n", + "Epoch 17/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0168 - acc: 0.9964 - val_loss: 0.0147 - val_acc: 0.9969\n", + "Epoch 18/50\n", + "40000/40000 [==============================] - 43s 1ms/sample - loss: 0.0179 - acc: 0.9959 - val_loss: 0.0125 - val_acc: 0.9968\n", + "Epoch 19/50\n", + "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0262 - acc: 0.9909 - val_loss: 0.0168 - val_acc: 0.9971\n", + "Epoch 20/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0169 - acc: 0.9961 - val_loss: 0.0128 - val_acc: 0.9971\n", + "Epoch 21/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0163 - acc: 0.9962 - val_loss: 0.0134 - val_acc: 0.9966\n", + "Epoch 22/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0165 - acc: 0.9966 - val_loss: 0.0121 - val_acc: 0.9971\n", + "Epoch 23/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0143 - acc: 0.9967 - val_loss: 0.0115 - val_acc: 0.9970\n", + "Epoch 24/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0266 - acc: 0.9909 - val_loss: 0.0170 - val_acc: 0.9971\n", + "Epoch 25/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0158 - acc: 0.9964 - val_loss: 0.0119 - val_acc: 0.9971\n", + "Epoch 26/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0190 - acc: 0.9951 - val_loss: 0.0146 - val_acc: 0.9959\n", + "Epoch 27/50\n", + "40000/40000 [==============================] - 46s 1ms/sample - loss: 0.0173 - acc: 0.9956 - val_loss: 0.0134 - val_acc: 0.9973\n", + "Epoch 28/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0120 - acc: 0.9970 - val_loss: 0.0130 - val_acc: 0.9972\n", + "Epoch 29/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0125 - acc: 0.9970 - val_loss: 0.0123 - val_acc: 0.9973\n", + "Epoch 30/50\n", + "40000/40000 [==============================] - 45s 1ms/sample - loss: 0.0121 - acc: 0.9970 - val_loss: 0.0127 - val_acc: 0.9969\n" + ] + } + ], + "source": [ + "model = Sequential()\n", + "model.add(Embedding(128, dim_embedding, input_length=maxLen))\n", + "model.add(SpatialDropout1D(dropout_rate))\n", + "model.add(LSTM(num_LSTM_cell, dropout=dropout_rate, recurrent_dropout=dropout_rate))\n", + "model.add(Dense(1, activation='sigmoid'))\n", + "model.compile(optimizer='adam', loss='binary_crossentropy', metrics=['accuracy'])\n", + "history = model.fit(xTrain, yTrain, epochs=epochs, batch_size=batch_size, validation_split=0.2, \n", + " callbacks=[EarlyStopping(monitor='val_loss',patience=7, min_delta=0.00001)])" + ] + }, + { + "cell_type": "markdown", + "metadata": {}, + "source": [ + "## Publish Model" + ] + }, + { + "cell_type": "code", + "execution_count": 5, + "metadata": {}, + "outputs": [], + "source": [ + "import os\n", + "import smle\n", + "import warnings\n", + "\n", + "warnings.filterwarnings('ignore')\n", + "from smle.context import Context\n", + "cwd = os.getcwd()\n", + "\n", + "config = { \n", + " 'username': '',\n", + " \n", + " 'model_storage_type': 's3', \n", + " 'model_storage_address': \"s3.us-west-2.amazonaws.com\",\n", + " 'model_storage_bucket': 'smle-experiments',\n", + " 'model_storage_access_key': '',\n", + " 'model_storage_secret_key': '',\n", + " 'model_storage_secure': False,\n", + "}\n", + "smle_context = Context(config)\n", + "\n", + "%load_ext spl2_kernel" + ] + }, + { + "cell_type": "code", + "execution_count": 6, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/smle/onnx.py:88: export_saved_model (from tensorflow.python.keras.saving.saved_model_experimental) is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Please use `model.save(..., save_format=\"tf\")` or `tf.keras.models.save_model(..., save_format=\"tf\")`.\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling GlorotUniform.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Call initializer instance with the dtype argument instead of passing it to the constructor\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Orthogonal.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Call initializer instance with the dtype argument instead of passing it to the constructor\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/ops/init_ops.py:97: calling Zeros.__init__ (from tensorflow.python.ops.init_ops) with dtype is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "Call initializer instance with the dtype argument instead of passing it to the constructor\n", + "WARNING:tensorflow:From /opt/conda/lib/python3.7/site-packages/tensorflow_core/python/saved_model/signature_def_utils_impl.py:253: build_tensor_info (from tensorflow.python.saved_model.utils_impl) is deprecated and will be removed in a future version.\n", + "Instructions for updating:\n", + "This function will only be available through the v1 compatibility library as tf.compat.v1.saved_model.utils.build_tensor_info or tf.compat.v1.saved_model.build_tensor_info.\n", + "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Train: ['train']\n", + "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", + "WARNING:tensorflow:Export includes no default signature!\n", + "INFO:tensorflow:No assets to save.\n", + "INFO:tensorflow:No assets to write.\n", + "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Predict: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Eval: ['eval']\n", + "WARNING:tensorflow:Export includes no default signature!\n", + "INFO:tensorflow:No assets to save.\n", + "INFO:tensorflow:No assets to write.\n", + "INFO:tensorflow:Signatures INCLUDED in export for Classify: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Regress: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Predict: ['serving_default']\n", + "INFO:tensorflow:Signatures INCLUDED in export for Train: None\n", + "INFO:tensorflow:Signatures INCLUDED in export for Eval: None\n", + "INFO:tensorflow:No assets to save.\n", + "INFO:tensorflow:No assets to write.\n", + "INFO:tensorflow:SavedModel written to: /tmp/phishing_email/saved_model.pb\n" + ] + } + ], + "source": [ + "model_path = \"models/phishing_email\"\n", + "model_name = \"phishing_email\"\n", + "\n", + "!rm -rf /tmp/{model_name}\n", + "sample_data = pd.read_csv('s3://smle-experiments/datasets/phishing_email/sample_file.csv')\n", + "smle_context.publish(model, model_name=model_name, path = model_path, sample= sample_data)" + ] + }, + { + "cell_type": "code", + "execution_count": 7, + "metadata": {}, + "outputs": [ + { + "name": "stdout", + "output_type": "stream", + "text": [ + "Metadata:\n", + "{'inputFields': [{'name': 'embedding_input:0',\n", + " 'size': 128,\n", + " 'type': 'floatTensor'}],\n", + " 'modelName': 'phishing_email',\n", + " 'outputFields': [{'name': 'dense/Sigmoid:0',\n", + " 'size': 1,\n", + " 'type': 'floatTensor'}]}\n", + "\n", + "ONNX model specs:\n", + "{'inputs': [{'name': 'embedding_input:0',\n", + " 'shape': ['unk__236', 128],\n", + " 'type': 'tensor(float)'}],\n", + " 'outputs': [{'name': 'dense/Sigmoid:0',\n", + " 'shape': ['unk__237', 1],\n", + " 'type': 'tensor(float)'}]}\n" + ] + } + ], + "source": [ + "import json\n", + "import onnxruntime as rt\n", + "from pprint import pprint\n", + "\n", + "\n", + "def inspect_model(dir_path, model_name):\n", + "\n", + " metadata = json.load(open(dir_path + \"metadata.json\"))\n", + " \n", + " print(\"Metadata:\")\n", + " pprint(metadata)\n", + " print()\n", + " \n", + " model_path = dir_path + model_name + \".onnx\"\n", + " sess = rt.InferenceSession(model_path)\n", + "\n", + " onnx_inputs = sess.get_inputs()\n", + " onnx_outputs = sess.get_outputs()\n", + "\n", + " inputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_inputs]\n", + " outputs = [{\"name\": node.name, \"type\": node.type, \"shape\": node.shape} for node in onnx_outputs]\n", + " onnx_model_specs = {\"inputs\": inputs, \"outputs\": outputs}\n", + " print(\"ONNX model specs:\")\n", + " \n", + " pprint(onnx_model_specs)\n", + "\n", + "\n", + "inspect_model(\"/tmp/\", model_name)" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + }, + { + "cell_type": "code", + "execution_count": 8, + "metadata": {}, + "outputs": [], + "source": [ + "%%spl2_add_params from_python\n", + "phishing_email = dict(\n", + " model_path = \"s3://smle-experiments/models/phishing_email\",\n", + " model_name = \"phishing_email\",\n", + " input_field = \"embedding_input:0\",\n", + ")" + ] + }, + { + "cell_type": "code", + "execution_count": 9, + "metadata": {}, + "outputs": [ + { + "data": { + "application/vnd.jupyter.widget-view+json": { + "model_id": "6aa0cfe6342a4e59b0ff9a68f1de5596", + "version_major": 2, + "version_minor": 0 + }, + "text/plain": [ + "HBox(children=(FloatProgress(value=0.0, max=5.0), HTML(value='')))" + ] + }, + "metadata": {}, + "output_type": "display_data" + }, + { + "name": "stdout", + "output_type": "stream", + "text": [ + " Finished. " + ] + }, + { + "data": { + "text/html": [ + "
\n", + "\n", + "\n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + " \n", + "
eventLineprobability
0karem ahmed <karemahmed-18@hotmail.fr> PLEA...[0.9720325]
1nkomo robert <nkomo002@5fm.za.com> FAMILY R...[0.9768889]
2Mrs Mariam Taylor <familyboxjanetfamilybo...[0.9780622999999999]
3Mr.Fred Chima <fredi@fastermail.com> busi...[0.97669697]
4Alexander Afadia <eeaesq@123.com> Please repl...[0.9775347999999999]
.........
82Comfort Somba. <comfort_somba11@yahoo.fr> F...[0.97327405]
83bintu pat <pat_bintu004@hotmail.com> TRUSTI...[0.96824765]
84FR RICHARD DAVID <unofice@katamail.com> FRO...[0.96306074]
85<joseph_m333@micasilla.net> Farmers Greetings...[0.97275084]
86MRS. LARISA SOSNITSKAYA <larisasosnkayapawou...[0.9751048999999999]
\n", + "

87 rows × 2 columns

\n", + "
" + ], + "text/plain": [ + " eventLine probability\n", + "0 karem ahmed PLEA... [0.9720325]\n", + "1 nkomo robert FAMILY R... [0.9768889]\n", + "2 Mrs Mariam Taylor busi... [0.97669697]\n", + "4 Alexander Afadia Please repl... [0.9775347999999999]\n", + ".. ... ...\n", + "82 Comfort Somba. F... [0.97327405]\n", + "83 bintu pat TRUSTI... [0.96824765]\n", + "84 FR RICHARD DAVID FRO... [0.96306074]\n", + "85 Farmers Greetings... [0.97275084]\n", + "86 MRS. LARISA SOSNITSKAYA " + ] + }, + "execution_count": 9, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "%%spl2 -q phishing_email\n", + "| from read_json(\"s3://smle-experiments/datasets/phishing_email/test.json\")\n", + "| eval eventLine=concat(From, \" \", Subject, \" \", Content, \" \", \" \")\n", + "| eval mapC = {\" \":32,\"!\":33,\"\\\"\":34,\"#\":35,\"$$\":36,\"%\":37,\"&\":38,\"'\":39,\"(\":40,\")\":41,\"*\":42,\"+\":43,\",\":44,\"-\":45,\".\":46,\"/\":47,\"0\":48,\"1\":49,\"2\":50,\"3\":51,\"4\":52,\"5\":53,\"6\":54,\"7\":55,\"8\":56,\"9\":57,\":\":58,\";\":59,\"<\":60,\"=\":61,\">\":62,\"?\":63,\"@\":64,\"A\":65,\"B\":66,\"C\":67,\"D\":68,\"E\":69,\"F\":70,\"G\":71,\"H\":72,\"I\":73,\"J\":74,\"K\":75,\"L\":76,\"M\":77,\"N\":78,\"O\":79,\"P\":80,\"Q\":81,\"R\":82,\"S\":83,\"T\":84,\"U\":85,\"V\":86,\"W\":87,\"X\":88,\"Y\":89,\"Z\":90,\"[\":91,\"\\\\\":92,\"]\":93,\"^\":94,\"_\":95,\"`\":96,\"a\":97,\"b\":98,\"c\":99,\"d\":100,\"e\":101,\"f\":102,\"g\":103,\"h\":104,\"i\":105,\"j\":106,\"k\":107,\"l\":108,\"m\":109,\"n\":110,\"o\":111,\"p\":112,\"q\":113,\"r\":114,\"s\":115,\"t\":116,\"u\":117,\"v\":118,\"w\":119,\"x\":120,\"y\":121,\"z\":122,\"{\":123,\"|\":124,\"}\":125,\"~\":126}\n", + "| eval 'embedding_input:0' = for_each(\n", + " iterator(mvrange(1,129), \"i\"),\n", + " cast(map_get(mapC, substr(eventLine, i, 1)), \"float\") )\n", + "| apply_model connection_id=\"\" path=\"$model_path\" name=\"$model_name\" \n", + "| rename 'dense/Sigmoid:0' AS probability \n", + "| where mvindex(probability, 0) > 0.5 \n", + "| select eventLine, probability \n", + ";" + ] + }, + { + "cell_type": "code", + "execution_count": 10, + "metadata": {}, + "outputs": [], + "source": [ + "df = _.df" + ] + }, + { + "cell_type": "code", + "execution_count": 11, + "metadata": { + "scrolled": true + }, + "outputs": [ + { + "data": { + "text/plain": [ + "\" karem ahmed PLEASE VERY URGENT. FROM THE DESK OF Mr,KAREM AHMED.BILL AND EXCHANGE MANAGER,BANK OF AFRICA (B.O.A) OUAGADOUGOU,BURKINA FASO WEST AFRICA.PHONE CONTACT 00226.78.89.77.34DEAR FRIEND,I know you may be surprise to recieve this e-mail ; I got your contact address from the internet while I was searching for my friend that has similar name with you.I am the manager of bill and exchange BANK OF AFRICA (B.O.A) at foreign remittance department.There is a business I would want you to champion for me, in my department I discovered an abandoned sum of ($31.500.000 U.S) thirty one million five hundred thousands US dollars)In an account that belongs to one of our foreign customer who died along with his entire family on 25TH JULY, 2000 CONCORDE PLANE CRASH [Flight AF4590] with the whole passengers aboard. The name of the deceased man was(MR.ANDREAS SCHRANNER from Munich Germany)N.B. In other for you to believe me honestly, visit the web site to enable you know whether we can work together, below is the website. http://news.bbc.co.uk/1/hi/world/europe/859479.stmYou have to understand that I come crossed this huge amount of money when I was arranging the departmental customers file to submit to the bank management for the annual audit of the year.Since we got information about his death, we have been expecting his next of kin to come over and claim his money because we cannot release it unless somebody applies for it as next of kin or relation to the deceased as indicated in our banking guidelines, but unfortunately we learnt that all his supposed next of kin's or relation died alongside with him at the plane crash leaving nobody behind for the claim.It is therefore upon this discovery that I now decided to make this business proposal to you and release the money to you as the next of kin or relation to the deceased for safety and subsequent disbursement since nobody is coming for it and I dont want this money to go into the Bank treasury as unclaimed Bill.The Banking law and guideline here stipulates that if such money remained unclaimed after some years, the money will be transferred into the Bank treasury as unclaimed fund.The request of foreigner as next of kin in this business is occasioned by the fact that the customer was a foreigner and a Burkina citizen cannot stand as next of kin to a foreigner.In fact I could have done this deal alone but because of my position in this country as a civil servant (A Banker), we are not allowed to operate any foreign account and would eventually raise an eye brow on my side during the time of transfer because I work in the same bank. This is the actual reason why it will require a second party or fellow who will forward claims as the next of kin to the Bank and also present a foreign account where he will need the money to be re-transferred into on his request as it may be after due verification and clarification by the correspondent branch of the bank where the whole money will be remitted from to your own designation bank account.I dont want this money to go into the Bank treasury as unclaimed Bill, I agree that 30 % of this money will be for you as foreign partner, in respect to the provision of a foreign account, 10 % will be set aside for expenses incurred during the business and 60 % would be for me. There after I will visit your country for disbursement according to the percentages indicated. Therefore to enable immediate transfer of this fund to you as arranged, you must apply first to the bank as relations or next of kin of the deceased indicating your bank name, your bank account number, your private telephone and fax number for easy and effective communication and location where in the money will be remitted.All modalities of this transaction have been carefully worked out and once started will not take more than fourteen (14) working days, with your full support.This transaction is 100% risk free. it involve no any implication and no any precaution there after.Upon receipt of your reply, I will send to you by fax or email the text of the application. I will not fail to bring to your notice that this transaction is hitch free and that you should not entertain any atom of fear as all required arrangements have been made for the transfer.You should contact me immediately as soon as you receive this letterreply to thi box. at;Trusting to hear from you immediately.Yours faithfully,Mr,KAREM AHMEDBill and exchange manager,BANK OF AFRICA_________________________________________________________________Personnalisez votre Messenger avec Live.com http://www.windowslive.fr/livecom/ \"" + ] + }, + "execution_count": 11, + "metadata": {}, + "output_type": "execute_result" + } + ], + "source": [ + "df.iloc[0]['eventLine']" + ] + }, + { + "cell_type": "code", + "execution_count": null, + "metadata": {}, + "outputs": [], + "source": [] + } + ], + "metadata": { + "kernelspec": { + "display_name": "Python 3", + "language": "python", + "name": "python3" + }, + "language_info": { + "codemirror_mode": { + "name": "ipython", + "version": 3 + }, + "file_extension": ".py", + "mimetype": "text/x-python", + "name": "python", + "nbconvert_exporter": "python", + "pygments_lexer": "ipython3", + "version": "3.7.6" + } + }, + "nbformat": 4, + "nbformat_minor": 4 +}