admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-07-19 09:57:11 -07:00
committed by GitHub
parent 9e36b6652c 3b689d2ba2
commit dc00b14093
78 changed files with 602 additions and 562 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/delete_shadowcopy_with_powershell.yml
+13 -11
View File
@@ -1,7 +1,7 @@
name: Delete ShadowCopy With PowerShell
id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
version: 1
date: '2021-05-12'
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,9 +11,10 @@ description: This following analytic detects PowerShell command to delete shadow
to deploy DarkSide Ransomware where it executed a child process of PowerShell to
execute a hex encoded command to delete shadow copy. This hex encoded command was
able to be decrypted by PowerShell log.
search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*"
OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*"
OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `delete_shadowcopy_with_powershell_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
@@ -32,11 +33,11 @@ tags:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 90
kill_chain_phases:
- Exploitation
message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$
message: An attempt to delete ShadowCopy was performed using PowerShell on $Computer$
by $User$.
mitre_attack_id:
- T1490
@@ -45,7 +46,7 @@ tags:
type: User
role:
- Victim
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -55,10 +56,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 81
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+14 -13
View File
@@ -1,7 +1,7 @@
name: Detect Empire with PowerShell Script Block Logging
id: bc1dc6b8-c954-11eb-bade-acde48001122
version: 1
date: '2021-06-09'
version: 2
date: '2022-02-24'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -19,9 +19,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 (Message=*system.net.webclient* AND Message=*frombase64string*)
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `detect_empire_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -35,6 +35,7 @@ references:
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://github.com/BC-SECURITY/Empire
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -44,21 +45,21 @@ tags:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log
impact: 90
kill_chain_phases:
- Exploitation
message: The following behavior was identified and typically related to PowerShell-Empire
on $ComputerName$ by $User$.
on $Computer$ by $UserID$.
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: User
- name: UserID
type: User
role:
- Victim
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -68,10 +69,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 81
security_domain: endpoint
detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+14 -12
View File
@@ -1,7 +1,7 @@
name: Detect Mimikatz With PowerShell Script Block Logging
id: 8148c29c-c952-11eb-9255-acde48001122
version: 1
date: '2021-06-09'
version: 2
date: '2022-02-24'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
search: '`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
*kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -32,6 +32,7 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -41,20 +42,21 @@ tags:
- Source:Endpoint
- Stage:Credential Access
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
impact: 90
kill_chain_phases:
- Exploitation
message: The following behavior was identified and typically related to MimiKatz
being loaded within the context of PowerShell on $ComputerName$ by $User$.
being loaded within the context of PowerShell on $Computer$ by $UserID$.
mitre_attack_id:
- T1003
- T1059.001
observable:
- name: User
- name: UserID
type: User
role:
- Victim
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -64,10 +66,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 90
security_domain: endpoint
detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+8 -8
View File
@@ -1,7 +1,7 @@
name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
id: 114c6bfe-9406-11ec-bcce-acde48001122
version: 1
date: '2022-02-22'
version: 2
date: '2022-05-03'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
their passwords offline.
search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -54,9 +53,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 54
security_domain: endpoint
detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+9 -9
View File
@@ -1,7 +1,7 @@
name: Disabled Kerberos Pre-Authentication Discovery With PowerView
id: b0b34e2c-90de-11ec-baeb-acde48001122
version: 1
date: '2022-02-18'
version: 2
date: '2022-05-03'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
and attempt to crack their passwords offline.
search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -34,7 +33,7 @@ tags:
- Stage:Discovery
- Stage:Recon
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
impact: 60
kill_chain_phases:
- Exploitation
@@ -53,9 +52,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 54
security_domain: endpoint
detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+12 -12
View File
@@ -1,8 +1,8 @@
name: Get ADUserResultantPasswordPolicy with Powershell Script Block
id: 737e1eb0-065a-11ec-921a-acde48001122
version: 1
date: '2021-08-26'
author: Teoderick Contreras, MAuricio Velazco, Splunk
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
used to obtain the password policy in a Windows domain. Red Teams and adversaries
alike may use PowerShell to enumerate domain policies for situational awareness
and Active Directory Discovery.
search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*"
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,16 +29,16 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: powershell process having commandline $Message$ to query domain user password
message: powershell process having commandline $ScriptBlockText$ to query domain user password
policy.
mitre_attack_id:
- T1201
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -53,10 +52,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 9
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: Get DomainPolicy with Powershell Script Block
id: a360d2b2-065a-11ec-b0bf-acde48001122
version: 1
date: '2021-08-26'
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel: []
@@ -9,8 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
to identify the execution of the `Get DomainPolicy` commandlet used to obtain the
password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell
to enumerate domain policies for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -28,19 +28,19 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log
impact: 50
kill_chain_phases:
- Reconnaissance
message: powershell process having commandline $Message$ to query domain policy.
message: powershell process having commandline $ScriptBlockText$ to query domain policy.
mitre_attack_id:
- T1201
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -50,10 +50,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 30
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+13 -14
View File
@@ -1,7 +1,7 @@
name: Get-DomainTrust with PowerShell Script Block
id: 89275e7e-0548-11ec-bf75-acde48001122
version: 1
date: '2021-08-24'
version: 2
date: '2022-05-02'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -17,8 +17,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -39,20 +39,20 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$
by user $user$.
message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$
by user $UserID$.
mitre_attack_id:
- T1482
observable:
- name: user
- name: UserID
type: User
role:
- Victim
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -66,12 +66,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- Path
- OpCode
- ComputerName
- User
risk_score: 12
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+12 -10
View File
@@ -1,7 +1,7 @@
name: Get-ForestTrust with PowerShell Script Block
id: 70fac80e-0bf1-11ec-9ba0-acde48001122
version: 1
date: '2021-09-02'
version: 2
date: '2022-02-24'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -28,6 +28,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab
known_false_positives: False positives may be present. Tune as needed.
references:
- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Active Directory Discovery
@@ -40,16 +41,17 @@ tags:
impact: 30
kill_chain_phases:
- Reconnaissance
message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$
by user $User$.
message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$
by user $UserID$.
mitre_attack_id:
- T1482
- T1059.001
observable:
- name: User
- name: UserID
type: User
role:
- Victim
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -60,11 +62,11 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ScriptBlockText
- Path
- OpCode
- ComputerName
- User
- Opcode
- Computer
- UserID
risk_score: 12
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getadcomputer_with_powershell_script_block.yml
+11 -10
View File
@@ -1,7 +1,7 @@
name: GetAdComputer with PowerShell Script Block
id: a9a1da02-8e27-4bf7-a348-f4389c9da487
version: 1
date: '2021-09-01'
version: 3
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: Hunting
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
is used to return a list of all domain computers. Red Teams and adversaries may
leverage this commandlet to enumerate domain computers for situational awareness
and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count
min(_time) as firstTime max(_time) as lastTime by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -33,11 +33,11 @@ tags:
impact: 30
kill_chain_phases:
- Reconnaissance
message: Remote system discovery enumeration on $dest$ by $user$
message: Remote system discovery enumeration on $Computer$ by $UserID$
mitre_attack_id:
- T1018
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -47,10 +47,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: GetDomainComputer with PowerShell Script Block
id: f64da023-b988-4775-8d57-38e512beb56e
version: 1
date: '2021-09-02'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
Red Teams and adversaries alike may use PowerView to enumerate domain computers
for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | stats count
min(_time) as firstTime max(_time) as lastTime by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -28,15 +28,15 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Remote system discovery with PowerView on $dest$ by $user$
message: Remote system discovery with PowerView on $Computer$ by $user$
mitre_attack_id:
- T1018
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -46,10 +46,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 24
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+11 -11
View File
@@ -1,7 +1,7 @@
name: GetDomainController with PowerShell Script Block
id: 676b600a-a94d-4951-b346-11329431e6c1
version: 1
date: '2021-09-02'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
Red Teams and adversaries alike may use PowerView to enumerate domain computers
for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") | stats
count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -29,15 +28,15 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Remote system discovery with PowerView on $dest$ by $user$
message: Remote system discovery with PowerView on $Computer$ by $UserID$
mitre_attack_id:
- T1018
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -47,10 +46,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 24
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+11 -11
View File
@@ -1,7 +1,7 @@
name: GetDomainGroup with PowerShell Script Block
id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
version: 1
date: '2021-08-26'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -11,9 +11,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams
and adversaries may leverage this function to enumerate domain groups for situational
awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats count
min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -30,16 +29,16 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Domain group discovery enumeration using PowerView on $dest$ by $user$
message: Domain group discovery enumeration using PowerView on $Computer$ by $UserID$
mitre_attack_id:
- T1069
- T1069.002
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -49,10 +48,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getlocaluser_with_powershell_script_block.yml
+9 -2
View File
@@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1087/001/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Active Directory Discovery
- Malicious PowerShell
confidence: 50
context:
- Source:Endpoint
@@ -34,12 +36,13 @@ tags:
impact: 30
kill_chain_phases:
- Reconnaissance
message: Local user discovery enumeration using PowerShell on $dest$ by $user$
message: Local user discovery enumeration using PowerShell on $Computer$ by $user$
mitre_attack_id:
- T1087
- T1087.001
- T1059.001
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -49,6 +52,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- EventCode
- ScriptBlockText
- Computer
- UserID
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: GetNetTcpconnection with PowerShell Script Block
id: 091712ff-b02a-4d43-82ed-34765515d95d
version: 1
date: '2021-09-10'
version: 2
date: '2022-04-02'
author: Mauricio Velazco, Splunk
type: Hunting
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
is used to return a listing of network connections on a compromised system. Red
Teams and adversaries alike may use this commandlet for situational awareness and
Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats
count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") | stats
count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -29,15 +29,15 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Network Connection discovery on $dest$ by $user$
message: Network Connection discovery on $Computer$ by $user$
mitre_attack_id:
- T1049
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -47,10 +47,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: GetWmiObject Ds Computer with PowerShell Script Block
id: 29b99201-723c-4118-847a-db2b3d3fb8ea
version: 1
date: '2021-09-01'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
parameter leverages WMI to query for all domain computers. Red Teams and adversaries
may leverage this commandlet to enumerate domain computers for situational awareness
and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace
root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `getwmiobject_ds_computer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,15 +30,15 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Remote system discovery enumeration on $dest$ by $user$
message: Remote system discovery enumeration on $Computer$ by $UserID$
mitre_attack_id:
- T1018
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -48,10 +48,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+10 -10
View File
@@ -1,7 +1,7 @@
name: GetWmiObject Ds Group with PowerShell Script Block
id: 67740bd3-1506-469c-b91d-effc322cc6e5
version: 1
date: '2021-08-25'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
. The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
and adversaries may leverage this commandlet to enumerate domain groups for situational
awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `getwmiobject_ds_group_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,11 +29,11 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$
mitre_attack_id:
- T1069
- T1069.002
@@ -49,10 +48,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
+11 -10
View File
@@ -1,7 +1,7 @@
name: GetWmiObject DS User with PowerShell Script Block
id: fabd364e-04f3-11ec-b34b-acde48001122
version: 1
date: '2021-08-24'
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
parameter leverages WMI to query for all domain users. Red Teams and adversaries
may leverage this commandlet to enumerate domain users for situational awareness
and Active Directory Discovery.
search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*"
ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
how_to_implement: he following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -33,12 +33,12 @@ tags:
impact: 50
kill_chain_phases:
- Reconnaissance
message: powershell process having commandline $Message$ for user enumeration
message: powershell process having commandline $ScriptBlockText$ for user enumeration
mitre_attack_id:
- T1087.002
- T1087
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -52,10 +52,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 25
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+14 -7
View File
@@ -1,7 +1,7 @@
name: GetWmiObject User Account with PowerShell Script Block
id: 640b0eda-0429-11ec-accd-acde48001122
version: 1
date: '2021-08-23'
version: 2
date: '2022-05-02'
author: Mauricio Velazco, Splunk
type: Hunting
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
The `Win32_UserAccount` parameter is used to return a list of all local users. Red
Teams and adversaries may leverage this commandlet to enumerate users for situational
awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
Computer UserID | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1087/001/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Active Directory Discovery
- Malicious PowerShell
confidence: 50
context:
- Source:Endpoint
@@ -32,12 +34,13 @@ tags:
impact: 30
kill_chain_phases:
- Reconnaissance
message: Local user discovery enumeration using PowerShell on $dest$ by $user$
message: Local user discovery enumeration using PowerShell on $Computer$ by $UserID$
mitre_attack_id:
- T1087
- T1087.001
- T1059.001
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -47,6 +50,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- EventCode
- ScriptBlockText
- Computer
- UserID
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/mailsniper_invoke_functions.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: Mailsniper Invoke functions
id: a36972c8-b894-11eb-9f78-acde48001122
version: 1
date: '2021-05-19'
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -9,12 +9,12 @@ datamodel:
description: This search is to detect known mailsniper.ps1 functions executed in a
machine. This technique was seen in some attacker to harvest some sensitive e-mail
in a compromised exchange server.
search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*",
"*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
"*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
"*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `mailsniper_invoke_functions_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
@@ -30,17 +30,17 @@ tags:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 90
kill_chain_phases:
- Exploitation
message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user
message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user
$user$.
mitre_attack_id:
- T1114
- T1114.001
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -54,10 +54,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 72
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_4104_hunting.yml
+32 -26
View File
@@ -1,7 +1,7 @@
name: PowerShell 4104 Hunting
id: d6f2b006-0041-11ec-8885-acde48001122
version: 1
date: '2021-08-18'
version: 3
date: '2022-05-02'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
@@ -10,26 +10,26 @@ description: The following Hunting analytic assists with identifying suspicious
to be ran hourly, but occasionally to identify malicious or suspicious PowerShell.
This analytic is a combination of work completed by Alex Teixeira and Splunk Threat
Research Team.
search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"),
"4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message,
search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
"4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText,
"(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
| eval base64 = if(match(lower(Message),"frombase64"), "4", 0) | eval empire=if(match(lower(Message),"system.net.webclient")
AND match(lower(Message), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(Message),"mimikatz")
OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR
match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden")
,5,0) | eval iex = if(match(lower(Message),"iex"), "2", 0) | eval webclient=if(match(lower(Message),"http")
OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket")
OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer")
OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0)
| eval get = if(match(lower(Message),"get-"), "1", 0) | eval rundll32 = if(match(lower(Message),"rundll32"),
"4", 0) | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
| eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0) | eval httplocal
= if(match(lower(Message),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(Message),"reflection"),
"1", 0) | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
| eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell
-version"),3,0) | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
| eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0) | addtotals
| eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient")
AND match(lower(ScriptBlockText), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz")
OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR
match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden")
,5,0) | eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0) | eval webclient=if(match(lower(ScriptBlockText),"http")
OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket")
OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer")
OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0)
| eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"),
"4", 0) | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
| eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) | eval httplocal
= if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(ScriptBlockText),"reflection"),
"1", 0) | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
| eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell
-version"),3,0) | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
| eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) | addtotals
fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz,
iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd,
base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz,
@@ -47,6 +47,7 @@ references:
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
- https://www.mandiant.com/resources/greater-visibilityt
- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -55,21 +56,22 @@ tags:
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ executing suspicious commands.
on endpoint $Computer$ by user $user$ executing suspicious commands.
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: user
- name: UserID
type: User
role:
- Victim
- name: dest
- name: Computer
type: Hostname
role:
- Victim
@@ -87,7 +89,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_creating_thread_mutex.yml
+13 -12
View File
@@ -1,7 +1,7 @@
name: Powershell Creating Thread Mutex
id: 637557ec-ca08-11eb-bd0a-acde48001122
version: 1
date: '2021-06-10'
version: 3
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel: []
@@ -11,8 +11,8 @@ description: The following analytic identifies suspicious PowerShell script exec
there process is running on a compromise machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -33,21 +33,22 @@ tags:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 50
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains Thread Mutex in $Message$ with
EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with
EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1027
- T1027.005
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -58,9 +59,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
risk_score: 40
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_domain_enumeration.yml
+14 -11
View File
@@ -1,7 +1,7 @@
name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 1
date: '2021-06-10'
version: 2
date: '2022-02-25'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -17,9 +17,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*,
search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*,
*get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
as firstTime max(_time) as lastTime by ComputerName EventCode Message | `security_content_ctime(firstTime)`
as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,6 +30,7 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -39,21 +40,21 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
impact: 60
kill_chain_phases:
- Reconnaissance
message: A suspicious powershell script contains domain enumeration command in $Message$
with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$
with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -63,8 +64,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- ComputerName
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 42
security_domain: endpoint
detections/endpoint/powershell_enable_smb1protocol_feature.yml
+9 -8
View File
@@ -1,7 +1,7 @@
name: Powershell Enable SMB1Protocol Feature
id: afed80b2-d34b-11eb-a952-acde48001122
version: 1
date: '2021-06-22'
version: 2
date: '2022-02-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -10,9 +10,9 @@ description: This search is to detect a suspicious enabling of smb1protocol thro
"powershell.exe". This technique was seen in some ransomware (like reddot) where
it enable smb share to do the lateral movement and encrypt other files within the
compromise network system.
search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message
search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText
= "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_enable_smb1protocol_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the powershell logs from your endpoints. make sure you enable needed
@@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
known_false_positives: network operator may enable or disable this windows feature.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -29,7 +30,7 @@ tags:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
kill_chain_phases:
- Exploitation
message: Powershell Enable SMB1Protocol Feature
@@ -48,9 +49,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
security_domain: endpoint
confidence: 50
impact: 50
detections/endpoint/powershell_execute_com_object.yml
+8 -4
View File
@@ -23,6 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
known_false_positives: network operrator may use this command.
references:
- https://threadreaderapp.com/thread/1423361119926816776.html
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -34,17 +35,17 @@ tags:
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log
impact: 10
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains COM CLSID command in $Message$
with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains COM CLSID command in $ScriptBlockText$
with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1546.015
- T1546
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -58,6 +59,9 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Computer
- EventCode
risk_score: 5
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+13 -12
View File
@@ -1,7 +1,7 @@
name: Powershell Fileless Process Injection via GetProcAddress
id: a26d9db4-c883-11eb-9d75-acde48001122
version: 1
date: '2021-06-08'
version: 2
date: '2022-02-25'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -21,8 +21,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -33,6 +33,7 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -42,18 +43,18 @@ tags:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 60
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains GetProcAddress API in $Message$
with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$
with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1059
- T1055
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -67,10 +68,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 48
security_domain: endpoint
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+10 -10
View File
@@ -1,7 +1,7 @@
name: Powershell Fileless Script Contains Base64 Encoded Content
id: 8acbc04c-c882-11eb-b060-acde48001122
version: 1
date: '2021-06-08'
version: 2
date: '2022-04-26'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -20,8 +20,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -41,7 +41,7 @@ tags:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log
impact: 70
kill_chain_phases:
- Exploitation
@@ -66,11 +66,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- EventCode
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCodes
risk_score: 56
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+10 -9
View File
@@ -1,7 +1,7 @@
name: Powershell Get LocalGroup Discovery with Script Block Logging
id: d7c6ad22-155c-11ec-bb64-acde48001122
version: 1
date: '2021-09-14'
version: 2
date: '2022-04-26'
author: Michael Haag, Splunk
type: Hunting
datamodel: []
@@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time)
as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode|
`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time)
as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -40,7 +40,7 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log
impact: 30
kill_chain_phases:
- Reconnaissance
@@ -63,10 +63,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+13 -14
View File
@@ -1,7 +1,7 @@
name: PowerShell Loading DotNET into Memory via Reflection
id: 85bc3f30-ca28-11eb-bd21-acde48001122
version: 1
date: '2021-06-10'
version: 2
date: '2022-05-02'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -19,9 +19,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
During triage, review parallel processes using an EDR product or 4688 events. It
will be important to understand the timeline of events around this activity. Review
the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*")
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_loading_dotnet_into_memory_via_reflection_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -43,21 +42,21 @@ tags:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log
impact: 70
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains reflective class assembly command
in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains reflective class assembly command
in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -67,10 +66,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 56
security_domain: endpoint
detections/endpoint/powershell_processing_stream_of_data.yml
+14 -13
View File
@@ -1,7 +1,7 @@
name: Powershell Processing Stream Of Data
id: 0d718b52-c9f1-11eb-bc61-acde48001122
version: 1
date: '2021-06-10'
version: 2
date: '2022-02-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel: []
@@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec
that are stream flattened and will be deflated durnig execution. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*"
OR ScriptBlockText = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -25,6 +25,7 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -34,22 +35,22 @@ tags:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log
impact: 50
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains stream command in $Message$ commonly
message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly
for processing compressed or to decompressed binary file with EventCode $EventCode$
in host $ComputerName$
in host $Computer$
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -60,9 +61,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
- Score
risk_score: 40
security_domain: endpoint
detections/endpoint/powershell_remove_windows_defender_directory.yml
+11 -12
View File
@@ -1,7 +1,7 @@
name: Powershell Remove Windows Defender Directory
id: adf47620-79fa-11ec-b248-acde48001122
version: 2
date: '2022-01-18'
version: 3
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,9 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to
campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
to then execute a PowerShell command to delete the Windows Defender folder. This
is a good indicator the offending process is trying corrupt a Windows Defender installation.
search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows
Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `powershell_remove_windows_defender_directory_filter` '
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -34,22 +32,22 @@ tags:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
impact: 100
kill_chain_phases:
- Exploitation
message: suspicious powershell script $Message$ was executed on the $ComputerName$
message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$
mitre_attack_id:
- T1562.001
- T1562
nist:
- DE.CM
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -59,10 +57,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 90
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/powershell_using_memory_as_backing_store.yml
+7 -7
View File
@@ -39,17 +39,17 @@ tags:
impact: 50
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains memorystream command in $Message$
as new object backstore with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains memorystream command in $ScriptBlockText$
as new object backstore with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1059.001
- T1059
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
@@ -60,9 +60,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
risk_score: 40
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+8 -7
View File
@@ -11,6 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec
adversary will map all running security applications or services. During triage,
review parallel processes within the same timeframe. Review the full script block
to identify other related artifacts.
search: '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*")
AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
@@ -27,6 +28,7 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
analytic_story:
- Hermetic Wiper
@@ -38,16 +40,15 @@ tags:
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
impact: 70
kill_chain_phases:
- Reconnaissance
message: A suspicious powershell script contains AV recon command in $Message$ with
EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains AV recon command in $ScriptBlockText$ with
EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1592
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -62,9 +63,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
risk_score: 56
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/recon_using_wmi_class.yml
+17 -15
View File
@@ -1,7 +1,7 @@
name: Recon Using WMI Class
id: 018c1972-ca07-11eb-9473-acde48001122
version: 1
date: '2021-06-10'
version: 2
date: '2022-02-25'
author: Teoderick Contreras, Splunk
type: TTP
datamodel: []
@@ -11,11 +11,11 @@ description: The following analytic identifies suspicious PowerShell via EventCo
and system information on the compromised machine. During triage, review parallel
processes within the same timeframe. Review the full script block to identify other
related artifacts.
search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*")
AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*"
OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*"
OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -27,10 +27,11 @@ references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
- https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
tags:
analytic_story:
- Hermetic Wiper
- Hermetic Wiper
- Malicious PowerShell
- Industroyer2
confidence: 80
@@ -38,16 +39,17 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
impact: 75
kill_chain_phases:
- Reconnaissance
message: A suspicious powershell script contains host recon command in $Message$
with EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains host recon command in $ScriptBlockText$
with EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1592
- T1059.001
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
@@ -62,9 +64,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
risk_score: 60
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+6 -5
View File
@@ -37,13 +37,13 @@ tags:
impact: 90
kill_chain_phases:
- Exploitation
message: A process was started on a remote endpoint from $ComputerName by abusing
message: A process was started on a remote endpoint from $Computer$ by abusing
WinRM using PowerShell.exe
mitre_attack_id:
- T1021
- T1021.006
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
@@ -53,10 +53,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 45
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+11 -11
View File
@@ -1,7 +1,7 @@
name: Remote System Discovery with Adsisearcher
id: 70803451-0047-4e12-9d63-77fa7eb8649c
version: 1
date: '2021-09-01'
version: 2
date: '2022-06-29'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
enumerate domain computers for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*"
AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*"
AND ScriptBlockText IN ("*findAll()*","*findOne()*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
| `remote_system_discovery_with_adsisearcher_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -29,15 +29,15 @@ tags:
- Stage:Discovery
- Stage:Recon
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Remote system discovery enumeration on $dest$ by $user$
message: Remote system discovery enumeration on $Computer$ by $user$
mitre_attack_id:
- T1018
observable:
- name: dest
- name: Computer
type: Endpoint
role:
- Victim
@@ -48,9 +48,9 @@ tags:
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
- ScriptBlockText
- Computer
- UserID
risk_score: 15
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+14 -19
View File
@@ -1,7 +1,7 @@
name: ServicePrincipalNames Discovery with PowerShell
id: 13243068-2d38-11ec-8908-acde48001122
version: 1
date: '2021-10-14'
version: 2
date: '2022-02-26'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -22,9 +22,9 @@ description: 'The following analytic identifies `powershell.exe` usage, using Sc
class in PowerShell is the equivelant of using setspn.exe. \
During triage, review parallel processes for further suspicious activity.'
search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" |
stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName
User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" |
stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer
UserID EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `serviceprincipalnames_discovery_with_powershell_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -49,6 +49,7 @@ tags:
analytic_story:
- Active Directory Discovery
- Active Directory Kerberos Attacks
- Malicious PowerShell
automated_detection_testing: passed
confidence: 100
context:
@@ -60,15 +61,15 @@ tags:
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest$ by user $user$ attempting to identify service principle names.
on endpoint $Computer$ by user $UserID$ attempting to identify service principle names.
mitre_attack_id:
- T1558.003
observable:
- name: user
- name: UserID
type: User
role:
- Victim
- name: dest
- name: Computer
type: Hostname
role:
- Victim
@@ -86,17 +87,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 80
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/unloading_amsi_via_reflection.yml
+6 -6
View File
@@ -48,13 +48,13 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$
message: Possible AMSI Unloading via Reflection using PowerShell on $Computer$
mitre_attack_id:
- T1562
- T1059.001
- T1059
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
@@ -64,10 +64,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 49
security_domain: endpoint
detections/endpoint/wmi_recon_running_process_or_services.yml
+12 -11
View File
@@ -1,7 +1,7 @@
name: WMI Recon Running Process Or Services
id: b5cd5526-cce7-11eb-b3bd-acde48001122
version: 1
date: '2021-06-14'
version: 2
date: '2022-05-02'
author: Teoderick Contreras, Splunk
type: TTP
datamodel: []
@@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec
where the adversary will map all running security applications or services on the
compromised machine. During triage, review parallel processes within the same timeframe.
Review the full script block to identify other related artifacts.
search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*"
OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*"
OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -33,17 +33,17 @@ tags:
- Source:Endpoint
- Stage:Recon
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
impact: 30
kill_chain_phases:
- Reconnaissance
message: Suspicious powerShell script execution by $user$ on $ComputerName$ via
message: Suspicious powerShell script execution by $user$ on $Computer$ via
EventCode 4104, where WMI is performing an event query looking for running processes
or running services
mitre_attack_id:
- T1592
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
@@ -57,10 +57,11 @@ tags:
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
- Message
- ComputerName
- User
risk_score: 30
security_domain: endpoint
asset_type: Endpoint
detections/experimental/endpoint/exchange_powershell_module_usage.yml
+9 -10
View File
@@ -1,7 +1,7 @@
name: Exchange PowerShell Module Usage
id: 2d10095e-05ae-11ec-8fdf-acde48001122
version: 1
date: '2021-08-27'
version: 2
date: '2022-05-02'
author: Michael Haag
type: TTP
datamodel: []
@@ -19,9 +19,9 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
Module - New-managementroleassignment can assign a management role to a management
role group, management role assignment policy, user, or universal security group
(USG).'
search: '`powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
| stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode
ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
| stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer
UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `exchange_powershell_module_usage_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -63,11 +63,10 @@ tags:
- Splunk Cloud
required_fields:
- _time
- Path
- Message
- OpCode
- ComputerName
- User
- ScriptBlockText
- Opcode
- Computer
- UserID
- EventCode
risk_score: 15
security_domain: endpoint
tests/endpoint/delete_shadowcopy_with_powershell.test.yml
+3 -3
View File
@@ -7,6 +7,6 @@ tests:
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: empire.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: credaccess-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
+4 -7
View File
@@ -6,10 +6,7 @@ tests:
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: get-aduser-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: getdomainuser.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/disabling_folderoptions_windows_feature.test.yml
+1 -1
View File
@@ -19,4 +19,4 @@ tests:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlogE
sourcetype: xmlwineventlog
tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+1 -1
View File
@@ -9,4 +9,4 @@ tests:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
sourcetype: xmlwineventlog
tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: domainpolicy.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog:Microsoft-Windows-PowerShell/Operational
- file_name: domaintrust.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+1 -1
View File
@@ -9,4 +9,4 @@ tests:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
sourcetype: xmlwineventlog
tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
+1 -1
View File
@@ -9,4 +9,4 @@ tests:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
sourcetype: xmlwineventlog
tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: getdc.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: domaingroup.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+1 -1
View File
@@ -9,4 +9,4 @@ tests:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
sourcetype: xmlwineventlog
tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: nettcpconnection.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/mailsniper_invoke_functions.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_4104_hunting.test.yml
+5 -4
View File
@@ -6,7 +6,8 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_testing/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_creating_thread_mutex.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_domain_enumeration.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: enumeration.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: frombase64string.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: getlocalgroup.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: reflection.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_processing_stream_of_data.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: streamreader.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/powershell_remove_windows_defender_directory.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/recon_using_wmi_class.test.yml
+3 -3
View File
@@ -7,6 +7,6 @@ tests:
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
+1 -1
View File
@@ -9,4 +9,4 @@ tests:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
sourcetype: xmlwineventlog
tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: adsisearcher-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell_kerberos.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: sbl_xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
tests/endpoint/wmi_recon_running_process_or_services.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: win32process.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog