Branch was auto-updated.

detections/endpoint/log4shell_cve_2021_44228_exploitation.yml

@@ -0,0 +1,74 @@
+name: Log4Shell CVE-2021-44228 Exploitation
+id: 9be30d80-3a39-4df9-9102-64a467b24eac
+version: 1
+date: '2022-01-26'
+author: Jose Hernandez, Splunk
+type: Correlation
+datamodel:
+- Risk
+description: 
+  This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story.
+  It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. 
+  If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation.
+  The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically
+   1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
+   2. Call back to malicious LDAP server eg. Exploit.class
+   3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001
+  Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), 
+  by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation.
+  If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.  
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime 
+ from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" 
+ by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source
+ | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)`
+ | `security_content_ctime(lastTime)`
+ | stats values(risk_object) as affected_systems  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics
+ | where distinct_tactics >= 2
+ | `log4shell_cve_2021_44228_exploitation_filter`'
+how_to_implement: To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.  
+known_false_positives: There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. 
+references:
+- https://research.splunk.com/stories/log4shell_cve-2021-44228/
+- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html
+tags:
+  analytic_story:
+  - Log4Shell CVE-2021-44228
+  dataset:
+  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/log4shell_exploitation/log4shell_correlation.txt
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1105
+  - T1190
+  - T1059
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - All_Risk.analyticstories
+  - All_Risk.risk_object_type
+  - All_Risk.risk_object 
+  - All_Risk.annotations.mitre_attack.mitre_tactic 
+  - source
+  security_domain: endpoint
+  impact: 90
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 63
+  context: 
+  message: Log4Shell Exploitation detected against $affected_systems$
+  observable:
+  - name: affected_systems
+    type: Hostname
+    role:
+    - Victim
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16

spec/detections.spec.json

@@ -164,7 +164,8 @@
           "UEBA",
           "Updates",
           "Vulnerabilities",
-          "Web"
+          "Web",
+          "Risk"
         ],
         "type": "string"
       },

tests/endpoint/log4shell_cve_2021_44228_exploitation.test.yml

@@ -0,0 +1,12 @@
+name: Log4Shell CVE-2021-44228 Exploitation Unit Test
+tests:
+- name: Log4Shell CVE-2021-44228 Exploitation 
+  file: endpoint/log4shell_cve_2021_44228_exploitation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: log4shell_correlation.txt
+    data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/log4shell_exploitation/log4shell_correlation.txt
+    source: log4shell
+    sourcetype: stash