adding new detection

detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml

@@ -0,0 +1,62 @@
+name: Windows IPC Share Accessed On Multiple Hosts
+id: d92f2d95-05fb-48a7-910f-4d3d61ab8655
+version: 1
+date: '2023-03-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: UPDATE_DESCRIPTION
+search: ' `wineventlog_security`  EventCode=5140 ShareName="\\\\*\\IPC$"
+  | bucket span=5m _time
+  | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName
+  | where unique_targets > 40
+  | `windows_ipc_share_accessed_on_multiple_hosts_filter`'
+how_to_implement: UPDATE_HOW_TO_IMPLEMENT
+known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+references:
+- https://attack.mitre.org/techniques/T1135/
+tags:
+  analytic_story:
+  - Active Directory Privilege Escalation
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: $IpAddress$ accessed the IPC share on more than 40 endpoints in a timespan of 5 minutes.
+  mitre_attack_id:
+  - T1135
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: IpAddress
+    type: Endpoint
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ShareName
+  - Computer
+  - IpAddress
+  - SubjectUserName
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/windows_local_administrator_credential_stuffing.yml

@@ -5,9 +5,12 @@ date: '2023-03-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
-description: The following analytic 
+description: The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, 
+  the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could
+  represent an adversary who has obtained access to credentials and is trying to validate if these credentials work on other hosts to escalate their privileges.
+   As environments differ across organizations, security teams should customize the thresholds of this detection.
 search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator
-  | bucket span=2m _time
+  | bucket span=5m _time
   | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode
   | where unique_targets > 30
   | `windows_local_administrator_credential_stuffing_filter`'
@@ -15,10 +18,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Windows Event Logs from domain controllers as well as member servers and workstations.
   The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
   to be enabled.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed.
 references:
 - https://attack.mitre.org/techniques/T1110/004/
 - https://attack.mitre.org/techniques/T1110/
+- https://www.blackhillsinfosec.com/wide-spread-local-admin-testing/
+- https://www.pentestpartners.com/security-blog/admin-password-re-use-dont-do-it/
+- https://www.praetorian.com/blog/microsofts-local-administrator-password-solution-laps/
+- https://wiki.porchetta.industries/smb-protocol/password-spraying
 tags:
   analytic_story:
   - Active Directory Privilege Escalation
@@ -52,7 +59,6 @@ tags:
     type: Endpoint
     role:
     - Attacker
-
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

detections/endpoint/windows_powershell_gpp_discovery.yml

@@ -9,7 +9,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po
   GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.
   These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).
   While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL.
-search: '`powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword)
+search: ' `powershell` EventCode=4104  (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword)
   | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_powershell_gpp_discovery_filter`'

tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml

@@ -0,0 +1,12 @@
+name: Windows IPC Share Accessed On Multiple Hosts Unit Test
+tests:
+- name: Windows IPC Share Accessed On Multiple Hosts
+  file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog