diff --git a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml new file mode 100644 index 0000000000..2b62c07a0e --- /dev/null +++ b/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml @@ -0,0 +1,62 @@ +name: Windows IPC Share Accessed On Multiple Hosts +id: d92f2d95-05fb-48a7-910f-4d3d61ab8655 +version: 1 +date: '2023-03-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=5140 ShareName="\\\\*\\IPC$" + | bucket span=5m _time + | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName + | where unique_targets > 40 + | `windows_ipc_share_accessed_on_multiple_hosts_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- https://attack.mitre.org/techniques/T1135/ +tags: + analytic_story: + - Active Directory Privilege Escalation + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log + impact: 70 + kill_chain_phases: + - Exploitation + message: $IpAddress$ accessed the IPC share on more than 40 endpoints in a timespan of 5 minutes. + mitre_attack_id: + - T1135 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: IpAddress + type: Endpoint + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ShareName + - Computer + - IpAddress + - SubjectUserName + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index e9c092d69c..c0c7a5c991 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -5,9 +5,12 @@ date: '2023-03-22' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic +description: The following analytic leverages events 4625 and 4624 to identify an endpoint using the builtin local Administrator account to authenticate to a large numbers of endpoints. Specifically, + the logic will trigger when an endpoints attempts to authenticate to more than 30 target computers within a 5 minute timespan. This behavior could + represent an adversary who has obtained access to credentials and is trying to validate if these credentials work on other hosts to escalate their privileges. + As environments differ across organizations, security teams should customize the thresholds of this detection. search: ' `wineventlog_security` EventCode=4625 OR EventCode=4624 Logon_Type=3 TargetUserName=Administrator - | bucket span=2m _time + | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName, EventCode | where unique_targets > 30 | `windows_local_administrator_credential_stuffing_filter`' @@ -15,10 +18,14 @@ how_to_implement: To successfully implement this search, you need to be ingestin Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: Vulnerability scanners or system administration tools may also trigger this detection. Filter as needed. references: - https://attack.mitre.org/techniques/T1110/004/ - https://attack.mitre.org/techniques/T1110/ +- https://www.blackhillsinfosec.com/wide-spread-local-admin-testing/ +- https://www.pentestpartners.com/security-blog/admin-password-re-use-dont-do-it/ +- https://www.praetorian.com/blog/microsofts-local-administrator-password-solution-laps/ +- https://wiki.porchetta.industries/smb-protocol/password-spraying tags: analytic_story: - Active Directory Privilege Escalation @@ -52,7 +59,6 @@ tags: type: Endpoint role: - Attacker - product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powershell_gpp_discovery.yml index 80ead31c17..757300a686 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powershell_gpp_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts. These group policies are stored in SYSVOL on a domain controller. This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public). While Microsoft released a patch that impedes Administrators to create unsecure credentials, existing Group Policy Preferences files with passwords are not removed from SYSVOL. -search: '`powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) +search: ' `powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_gpp_discovery_filter`' diff --git a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml new file mode 100644 index 0000000000..03f543afa5 --- /dev/null +++ b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml @@ -0,0 +1,12 @@ +name: Windows IPC Share Accessed On Multiple Hosts Unit Test +tests: +- name: Windows IPC Share Accessed On Multiple Hosts + file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/ipc_share_accessed/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog