From eea790282d826c803e82e030bd09b474c88a0af4 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Fri, 1 Sep 2023 10:18:27 -0700 Subject: [PATCH 01/10] First Draft - No test data --- ...domainacl_with_powershell_script_block.yml | 61 +++++++++++++++++++ ...minaccess_with_powershell_script_block.yml | 61 +++++++++++++++++++ ..._domainou_with_powershell_script_block.yml | 60 ++++++++++++++++++ ...estdomain_with_powershell_script_block.yml | 60 ++++++++++++++++++ 4 files changed, 242 insertions(+) create mode 100644 detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml create mode 100644 detections/endpoint/find_localadminaccess_with_powershell_script_block.yml create mode 100644 detections/endpoint/get_domainou_with_powershell_script_block.yml create mode 100644 detections/endpoint/get_forestdomain_with_powershell_script_block.yml diff --git a/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml b/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml new file mode 100644 index 0000000000..0209b6abae --- /dev/null +++ b/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Find InterestingDomainAcl with PowerShell Script Block +id: e4a96dfd-667a-4487-b942-ccef5a1e81e8 +version: 1 +date: '2023-08-31' +author: Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-InterestingDomainAcl` commandlet. + `Find-InterestingDomainAcl` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. + Detecting the use of `Find-InterestingDomainAcl` is crucial as adversaries and Red Teams might employ it to identify unusual or misconfigured Access Control Lists + (ACLs) within the domain. Such ACLs can provide attackers with insights into potential privilege escalation opportunities or weak security postures within + Active Directory. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `find_interestingdomainacl_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Red Teamers may use this command for Recon. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Find-InterestingDomainAcl/ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $Computer$ + by user $UserID$. + mitre_attack_id: + - T1087.002 + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: <> + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml b/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml new file mode 100644 index 0000000000..7d1a164dbb --- /dev/null +++ b/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Find LocalAdminAccess with PowerShell Script Block +id: d2988160-3ce9-4310-b59d-905334920cdd +version: 1 +date: '2023-08-31' +author: Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-LocalAdminAccess` commandlet. + `Find-LocalAdminAccess` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. + Detecting the use of `Find-LocalAdminAccess` is vital as adversaries and Red Teams might employ it to identify machines where the current user context + has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `find_localadminaccess_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Red Teamers may use this command for Recon. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Find-LocalAdminAccess/ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint $Computer$ + by user $UserID$. + mitre_attack_id: + - T1087.002 + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: <> + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/get_domainou_with_powershell_script_block.yml b/detections/endpoint/get_domainou_with_powershell_script_block.yml new file mode 100644 index 0000000000..81480ac48a --- /dev/null +++ b/detections/endpoint/get_domainou_with_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Get DomainOU with PowerShell Script Block +id: 0ada2f82-b7af-40cc-b1d7-1e5985afcb4e +version: 1 +date: '2023-08-31' +author: Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-DomainOU` commandlet. + `Get-DomainOU` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. + Identifying the use of `Get-DomainOU` is crucial as adversaries and Red Teams might employ it to gain insights into organizational units within Active Directory, + potentially aiding in lateral movement or privilege escalation strategies. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domainou_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainOU/ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: Suspicious PowerShell Get-DomainOU was identified on endpoint $Computer$ + by user $UserID$. + mitre_attack_id: + - T1087.002 + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: <> + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/get_forestdomain_with_powershell_script_block.yml b/detections/endpoint/get_forestdomain_with_powershell_script_block.yml new file mode 100644 index 0000000000..861ea75471 --- /dev/null +++ b/detections/endpoint/get_forestdomain_with_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Get ForestDomain with PowerShell Script Block +id: a14803b2-4bd9-4c08-8b57-c37980edebe8 +version: 1 +date: '2023-08-31' +author: Gowthamaraj Rajendran, Splunk +status: production +type: TTP +data_source: +- Powershell 4104 +description: This analytic utilizes PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-ForestDomain` commandlet. + `Get-ForestDomain` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Detecting the use of `Get-ForestDomain` + is essential as adversaries and Red Teams might employ it to gain insights into the forest and domain configurations of an Active Directory environment. + Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. +search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_forestdomain_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestDomain/ +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + confidence: 50 + impact: 50 + message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $Computer$ + by user $UserID$. + mitre_attack_id: + - T1087.002 + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: <> + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog From f3876753bd813ab101f5fdcfc72c53095a3ab736 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 5 Sep 2023 16:30:23 -0700 Subject: [PATCH 02/10] Update dataset --- ...d_interestingdomainacl_with_powershell_script_block.yml | 7 +++++-- .../find_localadminaccess_with_powershell_script_block.yml | 7 +++++-- .../endpoint/get_domainou_with_powershell_script_block.yml | 7 +++++-- .../get_forestdomain_with_powershell_script_block.yml | 7 +++++-- 4 files changed, 20 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml b/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml index 0209b6abae..6ed44ce890 100644 --- a/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml +++ b/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml @@ -19,9 +19,11 @@ search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainA how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: Red Teamers may use this command for Recon. +known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Find-InterestingDomainAcl/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview tags: analytic_story: - Active Directory Discovery @@ -31,6 +33,7 @@ tags: message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $Computer$ by user $UserID$. mitre_attack_id: + - T1087 - T1087.002 observable: - name: Computer @@ -56,6 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: <> + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-interestingACL-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: xmlwineventlog diff --git a/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml b/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml index 7d1a164dbb..163fbf262c 100644 --- a/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml +++ b/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml @@ -19,9 +19,11 @@ search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: Red Teamers may use this command for Recon. +known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Find-LocalAdminAccess/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview tags: analytic_story: - Active Directory Discovery @@ -31,6 +33,7 @@ tags: message: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint $Computer$ by user $UserID$. mitre_attack_id: + - T1087 - T1087.002 observable: - name: Computer @@ -56,6 +59,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: <> + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-LocalAdminAccess-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: xmlwineventlog diff --git a/detections/endpoint/get_domainou_with_powershell_script_block.yml b/detections/endpoint/get_domainou_with_powershell_script_block.yml index 81480ac48a..012faf0e6c 100644 --- a/detections/endpoint/get_domainou_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainou_with_powershell_script_block.yml @@ -18,9 +18,11 @@ search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: Administrators or power users may use this command for troubleshooting. +known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainOU/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview tags: analytic_story: - Active Directory Discovery @@ -30,6 +32,7 @@ tags: message: Suspicious PowerShell Get-DomainOU was identified on endpoint $Computer$ by user $UserID$. mitre_attack_id: + - T1087 - T1087.002 observable: - name: Computer @@ -55,6 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: <> + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-DomainOU-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: xmlwineventlog diff --git a/detections/endpoint/get_forestdomain_with_powershell_script_block.yml b/detections/endpoint/get_forestdomain_with_powershell_script_block.yml index 861ea75471..740f2e41f7 100644 --- a/detections/endpoint/get_forestdomain_with_powershell_script_block.yml +++ b/detections/endpoint/get_forestdomain_with_powershell_script_block.yml @@ -18,9 +18,11 @@ search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: Administrators or power users may use this command for troubleshooting. +known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestDomain/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview tags: analytic_story: - Active Directory Discovery @@ -30,6 +32,7 @@ tags: message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $Computer$ by user $UserID$. mitre_attack_id: + - T1087 - T1087.002 observable: - name: Computer @@ -55,6 +58,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: <> + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-ForestDomain-xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: xmlwineventlog From 545dcb72013bc84c0de4fe548f5929fb8d5560b4 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Mon, 11 Sep 2023 10:42:21 -0700 Subject: [PATCH 03/10] Rename File Name according to the Convention --- ...ndows_find_domain_organizational_units_with_getdomainou.yml} | 2 +- ...dows_find_interesting_acl_with_findinterestingdomainacl.yml} | 2 +- ...ck.yml => windows_forest_discovery_with_getforestdomain.yml} | 2 +- ...ml => windows_get_local_admin_with_findlocaladminaccess.yml} | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{get_domainou_with_powershell_script_block.yml => windows_find_domain_organizational_units_with_getdomainou.yml} (97%) rename detections/endpoint/{find_interestingdomainacl_with_powershell_script_block.yml => windows_find_interesting_acl_with_findinterestingdomainacl.yml} (97%) rename detections/endpoint/{get_forestdomain_with_powershell_script_block.yml => windows_forest_discovery_with_getforestdomain.yml} (98%) rename detections/endpoint/{find_localadminaccess_with_powershell_script_block.yml => windows_get_local_admin_with_findlocaladminaccess.yml} (97%) diff --git a/detections/endpoint/get_domainou_with_powershell_script_block.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml similarity index 97% rename from detections/endpoint/get_domainou_with_powershell_script_block.yml rename to detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index 012faf0e6c..4e2210aed0 100644 --- a/detections/endpoint/get_domainou_with_powershell_script_block.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -1,4 +1,4 @@ -name: Get DomainOU with PowerShell Script Block +name: Windows Find Domain Organizational Units with GetDomainOU id: 0ada2f82-b7af-40cc-b1d7-1e5985afcb4e version: 1 date: '2023-08-31' diff --git a/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml similarity index 97% rename from detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml rename to detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 6ed44ce890..b2d6bf3477 100644 --- a/detections/endpoint/find_interestingdomainacl_with_powershell_script_block.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -1,4 +1,4 @@ -name: Find InterestingDomainAcl with PowerShell Script Block +name: Windows Find Interesting ACL with FindInterestingDomainAcl id: e4a96dfd-667a-4487-b942-ccef5a1e81e8 version: 1 date: '2023-08-31' diff --git a/detections/endpoint/get_forestdomain_with_powershell_script_block.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml similarity index 98% rename from detections/endpoint/get_forestdomain_with_powershell_script_block.yml rename to detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 740f2e41f7..ed701ee3c3 100644 --- a/detections/endpoint/get_forestdomain_with_powershell_script_block.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -1,4 +1,4 @@ -name: Get ForestDomain with PowerShell Script Block +name: Windows Forest Discovery with GetForestDomain id: a14803b2-4bd9-4c08-8b57-c37980edebe8 version: 1 date: '2023-08-31' diff --git a/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml similarity index 97% rename from detections/endpoint/find_localadminaccess_with_powershell_script_block.yml rename to detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 163fbf262c..d9ebd73295 100644 --- a/detections/endpoint/find_localadminaccess_with_powershell_script_block.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -1,4 +1,4 @@ -name: Find LocalAdminAccess with PowerShell Script Block +name: Windows Get Local Admin with FindLocalAdminAccess id: d2988160-3ce9-4310-b59d-905334920cdd version: 1 date: '2023-08-31' From e743b6a4d78d4e25f98316f7569d70f3bb711f42 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Mon, 11 Sep 2023 11:04:20 -0700 Subject: [PATCH 04/10] Update filter --- ...indows_find_domain_organizational_units_with_getdomainou.yml | 2 +- ...ndows_find_interesting_acl_with_findinterestingdomainacl.yml | 2 +- .../endpoint/windows_forest_discovery_with_getforestdomain.yml | 2 +- .../windows_get_local_admin_with_findlocaladminaccess.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index 4e2210aed0..561191558f 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -14,7 +14,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `get_domainou_with_powershell_script_block_filter`' + | `windows_find_domain_organizational_units_with_getdomainou_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index b2d6bf3477..1bad6fdf3c 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -15,7 +15,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `find_interestingdomainacl_with_powershell_script_block_filter`' + | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index ed701ee3c3..659a01db89 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -14,7 +14,7 @@ description: This analytic utilizes PowerShell Script Block Logging (EventCode=4 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `get_forestdomain_with_powershell_script_block_filter`' + | `windows_forest_discovery_with_getforestdomain_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index d9ebd73295..72510c9acf 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -15,7 +15,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `find_localadminaccess_with_powershell_script_block_filter`' + | `windows_get_local_admin_with_findlocaladminaccess_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. From 9ab77032939e7f793e12e6bfd9bb0b32bf44fb45 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Mon, 11 Sep 2023 15:13:54 -0700 Subject: [PATCH 05/10] Added Contributors --- ...indows_find_domain_organizational_units_with_getdomainou.yml | 2 +- ...ndows_find_interesting_acl_with_findinterestingdomainacl.yml | 2 +- .../endpoint/windows_forest_discovery_with_getforestdomain.yml | 2 +- .../windows_get_local_admin_with_findlocaladminaccess.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index 561191558f..bfea1c3c79 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -2,7 +2,7 @@ name: Windows Find Domain Organizational Units with GetDomainOU id: 0ada2f82-b7af-40cc-b1d7-1e5985afcb4e version: 1 date: '2023-08-31' -author: Gowthamaraj Rajendran, Splunk +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP data_source: diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 1bad6fdf3c..459d1e5e5b 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -2,7 +2,7 @@ name: Windows Find Interesting ACL with FindInterestingDomainAcl id: e4a96dfd-667a-4487-b942-ccef5a1e81e8 version: 1 date: '2023-08-31' -author: Gowthamaraj Rajendran, Splunk +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP data_source: diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 659a01db89..ed47842bc4 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -2,7 +2,7 @@ name: Windows Forest Discovery with GetForestDomain id: a14803b2-4bd9-4c08-8b57-c37980edebe8 version: 1 date: '2023-08-31' -author: Gowthamaraj Rajendran, Splunk +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP data_source: diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 72510c9acf..525a0e842d 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -2,7 +2,7 @@ name: Windows Get Local Admin with FindLocalAdminAccess id: d2988160-3ce9-4310-b59d-905334920cdd version: 1 date: '2023-08-31' -author: Gowthamaraj Rajendran, Splunk +author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production type: TTP data_source: From f12ba109e7a0076089c3d4c7fb2a43a23552da36 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 12 Sep 2023 14:14:10 -0700 Subject: [PATCH 06/10] Update CIM, add macros --- ...domain_organizational_units_with_getdomainou.yml | 13 +++++++------ ...nteresting_acl_with_findinterestingdomainacl.yml | 13 +++++++------ ...indows_forest_discovery_with_getforestdomain.yml | 13 +++++++------ ...ws_get_local_admin_with_findlocaladminaccess.yml | 13 +++++++------ macros/windows_powershell_rename.yml | 3 +++ 5 files changed, 31 insertions(+), 24 deletions(-) create mode 100644 macros/windows_powershell_rename.yml diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index bfea1c3c79..da70b9a2fd 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -12,6 +12,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= Identifying the use of `Get-DomainOU` is crucial as adversaries and Red Teams might employ it to gain insights into organizational units within Active Directory, potentially aiding in lateral movement or privilege escalation strategies. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" + | `windows_rename_to_cim` | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' @@ -29,17 +30,17 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Get-DomainOU was identified on endpoint $Computer$ - by user $UserID$. + message: Suspicious PowerShell Get-DomainOU was identified on endpoint $dest$ + by user $user$. mitre_attack_id: - T1087 - T1087.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim @@ -51,8 +52,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 459d1e5e5b..9f5a559909 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -13,6 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= (ACLs) within the domain. Such ACLs can provide attackers with insights into potential privilege escalation opportunities or weak security postures within Active Directory. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" + | `windows_rename_to_cim` | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' @@ -30,17 +31,17 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $Computer$ - by user $UserID$. + message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $dest$ + by user $user$. mitre_attack_id: - T1087 - T1087.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim @@ -52,8 +53,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index ed47842bc4..4a4e9d5b53 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -12,6 +12,7 @@ description: This analytic utilizes PowerShell Script Block Logging (EventCode=4 is essential as adversaries and Red Teams might employ it to gain insights into the forest and domain configurations of an Active Directory environment. Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" + | `windows_rename_to_cim` | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' @@ -29,17 +30,17 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $Computer$ - by user $UserID$. + message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $dest$ + by user $user$. mitre_attack_id: - T1087 - T1087.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim @@ -51,8 +52,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 25 security_domain: endpoint tests: diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 525a0e842d..357ba5f839 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -12,6 +12,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= Detecting the use of `Find-LocalAdminAccess` is vital as adversaries and Red Teams might employ it to identify machines where the current user context has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" + | `windows_rename_to_cim` | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -30,17 +31,17 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint $Computer$ - by user $UserID$. + message: Suspicious PowerShell Find-LocalAdminAccess was identified on endpoint $dest$ + by user $user$. mitre_attack_id: - T1087 - T1087.002 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: UserID + - name: user type: User role: - Victim @@ -52,8 +53,8 @@ tags: - _time - EventCode - Message - - ComputerName - - User + - Computer + - UserID risk_score: 25 security_domain: endpoint tests: diff --git a/macros/windows_powershell_rename.yml b/macros/windows_powershell_rename.yml new file mode 100644 index 0000000000..c5f454cbd5 --- /dev/null +++ b/macros/windows_powershell_rename.yml @@ -0,0 +1,3 @@ +definition: rename Computer as dest, UserID as user +description: rename windows fields to CIM +name: windows_rename_to_cim \ No newline at end of file From 6a3c737845702c26da70300f8a69d4a165cce6b9 Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 12 Sep 2023 14:39:44 -0700 Subject: [PATCH 07/10] edit macro --- .../{windows_powershell_rename.yml => windows_rename_to_cim.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename macros/{windows_powershell_rename.yml => windows_rename_to_cim.yml} (100%) diff --git a/macros/windows_powershell_rename.yml b/macros/windows_rename_to_cim.yml similarity index 100% rename from macros/windows_powershell_rename.yml rename to macros/windows_rename_to_cim.yml From 439cf218eb895112ec41fbb4ff25dd50f29ec95e Mon Sep 17 00:00:00 2001 From: Gowthamaraj rajendran Date: Tue, 12 Sep 2023 17:07:34 -0700 Subject: [PATCH 08/10] Update SPL --- ...indows_find_domain_organizational_units_with_getdomainou.yml | 2 +- ...ndows_find_interesting_acl_with_findinterestingdomainacl.yml | 2 +- .../endpoint/windows_forest_discovery_with_getforestdomain.yml | 2 +- .../windows_get_local_admin_with_findlocaladminaccess.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index da70b9a2fd..c219db4001 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= potentially aiding in lateral movement or privilege escalation strategies. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 9f5a559909..9ebeba5c7c 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -14,7 +14,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= Active Directory. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 4a4e9d5b53..39af062361 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -13,7 +13,7 @@ description: This analytic utilizes PowerShell Script Block Logging (EventCode=4 Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 357ba5f839..13861b2523 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode= has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_local_admin_with_findlocaladminaccess_filter`' From df48560256a857c34f5c1d3100140a39f67192e7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 14 Sep 2023 14:02:06 -0700 Subject: [PATCH 09/10] spl fixes --- ...ain_organizational_units_with_getdomainou.yml | 12 +++--------- ...resting_acl_with_findinterestingdomainacl.yml | 16 ++++------------ ...ows_forest_discovery_with_getforestdomain.yml | 15 ++++----------- ...get_local_admin_with_findlocaladminaccess.yml | 8 ++------ 4 files changed, 13 insertions(+), 38 deletions(-) diff --git a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml index c219db4001..28d76a25a0 100644 --- a/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml +++ b/detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml @@ -7,18 +7,12 @@ status: production type: TTP data_source: - Powershell 4104 -description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-DomainOU` commandlet. - `Get-DomainOU` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. - Identifying the use of `Get-DomainOU` is crucial as adversaries and Red Teams might employ it to gain insights into organizational units within Active Directory, - potentially aiding in lateral movement or privilege escalation strategies. +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-DomainOU` commandlet. `Get-DomainOU` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Identifying the use of `Get-DomainOU` is crucial as adversaries and Red Teams might employ it to gain insights into organizational units within Active Directory, potentially aiding in lateral movement or privilege escalation strategies. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" - | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_domain_organizational_units_with_getdomainou_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainOU/ diff --git a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml index 9ebeba5c7c..d2e2188c6d 100644 --- a/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml +++ b/detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml @@ -7,19 +7,12 @@ status: production type: TTP data_source: - Powershell 4104 -description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-InterestingDomainAcl` commandlet. - `Find-InterestingDomainAcl` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. - Detecting the use of `Find-InterestingDomainAcl` is crucial as adversaries and Red Teams might employ it to identify unusual or misconfigured Access Control Lists - (ACLs) within the domain. Such ACLs can provide attackers with insights into potential privilege escalation opportunities or weak security postures within - Active Directory. +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-InterestingDomainAcl` commandlet. `Find-InterestingDomainAcl` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Detecting the use of `Find-InterestingDomainAcl` is crucial as adversaries and Red Teams might employ it to identify unusual or misconfigured Access Control Lists (ACLs) within the domain. Such ACLs can provide attackers with insights into potential privilege escalation opportunities or weak security postures within Active Directory. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" - | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Find-InterestingDomainAcl/ @@ -31,8 +24,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $dest$ - by user $user$. + message: Suspicious PowerShell Find-InterestingDomainAcl was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1087 - T1087.002 diff --git a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml index 39af062361..16a59f7179 100644 --- a/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml +++ b/detections/endpoint/windows_forest_discovery_with_getforestdomain.yml @@ -7,18 +7,12 @@ status: production type: TTP data_source: - Powershell 4104 -description: This analytic utilizes PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-ForestDomain` commandlet. - `Get-ForestDomain` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Detecting the use of `Get-ForestDomain` - is essential as adversaries and Red Teams might employ it to gain insights into the forest and domain configurations of an Active Directory environment. - Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. +description: This analytic utilizes PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Get-ForestDomain` commandlet. `Get-ForestDomain` is a component of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Detecting the use of `Get-ForestDomain` is essential as adversaries and Red Teams might employ it to gain insights into the forest and domain configurations of an Active Directory environment. Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation. search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" - | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_forest_discovery_with_getforestdomain_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs - to be imported. Modify the powershell macro as needed to match the sourcetype or - add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestDomain/ @@ -30,8 +24,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $dest$ - by user $user$. + message: Suspicious PowerShell Get-ForestDomain was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1087 - T1087.002 diff --git a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml index 13861b2523..8b67b57df5 100644 --- a/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml +++ b/detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml @@ -7,13 +7,9 @@ status: production type: TTP data_source: - Powershell 4104 -description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-LocalAdminAccess` commandlet. - `Find-LocalAdminAccess` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. - Detecting the use of `Find-LocalAdminAccess` is vital as adversaries and Red Teams might employ it to identify machines where the current user context - has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. +description: This analytic leverages PowerShell Script Block Logging (EventCode=4104) to detect the execution of the `Find-LocalAdminAccess` commandlet. `Find-LocalAdminAccess` is part of PowerView, a PowerShell toolkit designed for Windows domain enumeration. Detecting the use of `Find-LocalAdminAccess` is vital as adversaries and Red Teams might employ it to identify machines where the current user context has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network. search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" - | `windows_rename_to_cim` - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_get_local_admin_with_findlocaladminaccess_filter`' From a0f7f081e1ecbd1ac9290dd037946a0d8f848567 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 14 Sep 2023 14:29:45 -0700 Subject: [PATCH 10/10] remove macro --- macros/windows_rename_to_cim.yml | 3 --- 1 file changed, 3 deletions(-) delete mode 100644 macros/windows_rename_to_cim.yml diff --git a/macros/windows_rename_to_cim.yml b/macros/windows_rename_to_cim.yml deleted file mode 100644 index c5f454cbd5..0000000000 --- a/macros/windows_rename_to_cim.yml +++ /dev/null @@ -1,3 +0,0 @@ -definition: rename Computer as dest, UserID as user -description: rename windows fields to CIM -name: windows_rename_to_cim \ No newline at end of file