adding 2 extra detections

detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml

@@ -0,0 +1,40 @@
+name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos
+id: 98f22d82-9d62-11eb-9fcf-acde48001122
+version: 1
+date: '2021-04-14'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. 
+  This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain 
+  initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack against disabled users. 
+  In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments.
+  Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x12 means 
+  'client’s credentials have been revoked' (account disabled, expired or locked out.
+
+  This detection will trigger on the domain controller against which the offending host performs the password spraying attack.
+
+  The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
+search: 'EventCode=4768 Result_Code=0x12 | stats  dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address  | where  unique_accounts > 10'
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting 
+'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios 
+include but are not limited to vulnerability scanners and missconfigured systems.
+references:
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1110.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint

detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml

@@ -0,0 +1,40 @@
+name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos 
+id: 001266a6-9d5b-11eb-829b-acde48001122
+version: 1
+date: '2021-04-14'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. 
+  This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain 
+  initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. I certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. 
+  In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments.
+  Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 means 
+  'client not found in Kerberos database' (the attempted user is not a valid domain user).
+
+  This detection will trigger on the domain controller against which the offending host performs the password spraying attack.
+
+  The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
+search: 'EventCode=4768 Result_Code=0x6 | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by Client_Address | where unique_accounts > 10 '
+how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting 
+'Audit Kerberos Authentication Service' within 'Account Logon' needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios 
+include but are not limited to vulnerability scanners and missconfigured systems.
+references:
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1110.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint

detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml

@@ -1,4 +1,4 @@
-name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos
+name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos
 id: 3a91a212-98a9-11eb-b86a-acde48001122
 version: 1
 date: '2021-04-08'

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml

@@ -0,0 +1,42 @@
+name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets
+id: e345917c-9ded-11eb-a15f-acde48001122
+version: 1
+date: '2021-04-15'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies a source host failing to authenticate against several remote hosts with multiple users in a distributed way.
+This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. 
+ In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments.
+ Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers and workstations. Logon Type 3 
+ describes an remote authentication attempt.
+
+ This detection will trigger on the hosts that are the targets of the password spraying attack. These could be domain controllers and/or member servers or workstations.
+
+ The analytic's returned fields allow analysts to investigate the event further by providing fields like source ip, target hosts and target users.
+
+search: 'EventCode=4625 Logon_Type=3 Source_Network_Address!="-" | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(ComputerName) as target_hosts values(Destination_Account) as tried_accounts by Source_Network_Address | where unique_accounts > 3'
+how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as 
+as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled.
+known_false_positives: A host failing to authenticate with multiple users against multiple targets is not common behavior for a legitimate system. Possible false positive scenarios 
+include but are not limited to vulnerability scanners, remote administration tools and missconfigured systems.
+references:
+  - https://attack.mitre.org/techniques/T1110/003/ 
+  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+tags:
+  analytic_story:
+  - Active Directory Password Spraying
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1110.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint

detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml

@@ -29,9 +29,7 @@ references:
   - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 tags:
   analytic_story:
-  - UPDATE_STORY_NAME
-  dataset:
-  - UPDATE_DATASET_URL
+  - Active Directory Password Spraying
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

tests/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos Unit Test
+tests:
+- name: Multiple Disabled Users Failing To Authenticate From One Source Using Kerberos
+  file: detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_one_source_using_kerberos.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos  Unit Test
+tests:
+- name: Multiple Invalid Users Failing To Authenticate From One Source Using Kerberos 
+  file: detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_one_source_using_kerberos_.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE

tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml

@@ -1,6 +1,6 @@
-name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos Unit Test
+name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos Unit Test
 tests:
-- name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos
+- name: Multiple Valid Users Failing To Authenticate From One Source Using Kerberos
   file: endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.test.yml

@@ -0,0 +1,12 @@
+name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets Unit Test
+tests:
+- name: Multiple Users Remotely Failing To Authenticate From One Source Against Multiple Targets
+  file: detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_one_source_against_multiple_targets.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE