diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 index 908485a54d..b28124a95d 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 @@ -47,17 +47,19 @@ We have not been able to test, simulate, or build datasets for this object. Use - **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: {{ object.tags.product|join(', ') }} {% if object.datamodel -%}- **Datamodel**: {% for datamodel in object.datamodel %}[{{ datamodel }}](https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %} -{% if object.splunk_app_enrichment -%}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %} +{%- if object.splunk_app_enrichment -%}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %} - **Last Updated**: {{ object.date }} - **Author**: {{object.author}} - **ID**: {{ object.id }} -#### Metadata +#### Annotations
ATT&CK +
+ {% if object.tags.mitre_attack_id %} | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -71,44 +73,56 @@ We have not been able to test, simulate, or build datasets for this object. Use {% endif -%} {% endfor %} {% endif -%} + +
Kill Chain Phase +
+ {% for phase in object.annotations.kill_chain_phases -%} * {{ phase }} {% endfor %} +
NIST +
+ {% if object.annotations.nist -%} {% for nist in object.annotations.nist -%} * {{ nist }} {% endfor %} {% endif %} +
CIS20 +
+ {% if object.annotations.cis20 -%} {% for cis in object.annotations.cis20 -%} * {{ cis }} {% endfor %} {% endif %} +
CVE +
{% if object.cve_enrichment -%} | ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | @@ -117,6 +131,7 @@ We have not been able to test, simulate, or build datasets for this object. Use {% endfor %} {% endif %} +
#### Search @@ -135,7 +150,7 @@ The SPL above uses the following Macros: {% endfor %} {% endif -%} -Note that `{{object.name | lower | replace(" ", "_") }}_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **{{object.name | lower | replace(" ", "_") }}_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. {% if object.lookups -%} #### Lookups @@ -179,7 +194,7 @@ The SPL above uses the following Lookups: {% endif %} #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) {% if object.tags.dataset %} diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2 index 57564176b5..70990d4176 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2 @@ -5,8 +5,8 @@ main: url: /stories/ - title: "Playbooks" url: /playbooks/ - - title: "Tags" - url: /tags/ + - title: "Blog" + url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html - title: "About" url: https://www.splunk.com/en_us/cyber-security/threat-research.html detections: diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml index 59e10dd5bc..d9e4b49254 100644 --- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml +++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml @@ -11,8 +11,10 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases - of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` - 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral + of a Log4Shell exploitation, specifically: + 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` + 2. Call back to malicious LDAP server eg. Exploit.class + 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation diff --git a/docs/_config.yml b/docs/_config.yml index 32d6c901ee..d9a5f24b1d 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -32,8 +32,26 @@ minimal_mistakes_skin: "contrast" #default, neon, dark are also options # Build settings markdown: kramdown highlighter: rouge +lsi: false +excerpt_separator: "\n\n" +incremental: false +# Markdown Processing +kramdown: + input: GFM + hard_wrap: false + auto_ids: true + footnote_nr: 1 + entity_output: as_char + toc_levels: 1..6 + smart_quotes: lsquo,rsquo,ldquo,rdquo + enable_coderay: false + syntax_highlighter_opts: + block: + line_numbers: true + remote_theme: mmistakes/minimal-mistakes + # Outputting permalink: /:categories/:title/ paginate: 5 # amount of posts to show diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml index 2c953991c3..8f25568ada 100644 --- a/docs/_data/navigation.yml +++ b/docs/_data/navigation.yml @@ -5,8 +5,8 @@ main: url: /stories/ - title: "Playbooks" url: /playbooks/ - - title: "Tags" - url: /tags/ + - title: "Blog" + url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html - title: "About" url: https://www.splunk.com/en_us/cyber-security/threat-research.html detections: diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index c21ea41251..20abefa5c9 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -25,32 +25,39 @@ The search is used to detect systems that are still vulnerable to the Spectre an - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Vulnerabilities](https://docs.splunk.com/Documentation/CIM/latest/User/Vulnerabilities) - - **Last Updated**: 2017-01-07 - **Author**: David Dorsey, Splunk - **ID**: 354be8e0-32cd-4da0-8c47-796de13b60ea -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.RA * RS.MI * PR.IP @@ -58,26 +65,32 @@ The search is used to detect systems that are still vulnerable to the Spectre an +
CIS20 +
+ * CIS 4 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 | +
#### Search @@ -93,10 +106,10 @@ The search is used to detect systems that are still vulnerable to the Spectre an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `spectre_and_meltdown_vulnerable_systems_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ It is possible that your vulnerability scanner is not detecting that the patches #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index a6a8f3b880..0917a3d674 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -26,54 +26,67 @@ The search queries the authentication logs for assets that are categorized as ro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2017-09-12 - **Author**: Bhavin Patel, Splunk - **ID**: bce3ed7c-9b1f-42a0-abdf-d8b123a34836 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AC * PR.IP +
CIS20 +
+ * CIS 11 +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The search queries the authentication logs for assets that are categorized as ro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_login_attempts_to_routers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Legitimate router connections may appear as new connections #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index a78dbf195a..b62622a8d1 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -23,52 +23,65 @@ This search returns a list of hosts that have not successfully completed a backu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2017-09-12 - **Author**: David Dorsey, Splunk - **ID**: a34aae96-ccf8-4aef-952c-3ea214444440 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 10 +
CVE +
+
#### Search @@ -86,10 +99,10 @@ This search returns a list of hosts that have not successfully completed a backu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `extended_period_without_successful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -120,7 +133,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-12-identify_new_user_accounts.md b/docs/_posts/2017-09-12-identify_new_user_accounts.md index 66b8a53804..4cd639a7ed 100644 --- a/docs/_posts/2017-09-12-identify_new_user_accounts.md +++ b/docs/_posts/2017-09-12-identify_new_user_accounts.md @@ -29,57 +29,70 @@ This detection search will help profile user accounts in your environment by ide - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2017-09-12 - **Author**: Bhavin Patel, Splunk - **ID**: 475b9e27-17e4-46e2-b7e2-648221be3b89 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -99,7 +112,7 @@ This detection search will help profile user accounts in your environment by ide The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `identify_new_user_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ If the Identity_Management data model is not updated regularly, this search coul #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index c8877a876e..0e4e2f3e76 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -23,52 +23,65 @@ This search gives you the hosts where a backup was attempted and then failed. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2017-09-12 - **Author**: David Dorsey, Splunk - **ID**: a34aae96-ccf8-4aaa-952c-3ea21444444f -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 10 +
CVE +
+
#### Search @@ -85,10 +98,10 @@ This search gives you the hosts where a backup was attempted and then failed. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unsuccessful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -117,7 +130,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 3a94e8bce1..11d626a206 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -26,55 +26,68 @@ By populating the organization's assets within the assets_by_str.csv, we will be - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Sessions](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions) - - **Last Updated**: 2017-09-13 - **Author**: Bhavin Patel, Splunk - **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Reconnaissance * Delivery * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -96,7 +109,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_unauthorized_assets_by_mac_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ This search might be prone to high false positives. Please consider this when co #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index c112405b93..e5c9ae0f7f 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -26,53 +26,66 @@ This search looks for Windows endpoints that have not generated an event indicat - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Updates](https://docs.splunk.com/Documentation/CIM/latest/User/Updates) - - **Last Updated**: 2017-09-15 - **Author**: Bhavin Patel, Splunk - **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * PR.MA +
CIS20 +
+ * CIS 18 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search looks for Windows endpoints that have not generated an event indicat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `no_windows_updates_in_a_time_frame_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index 145567ef6c..bf41182a1c 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -26,52 +26,65 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) - - **Last Updated**: 2017-09-19 - **Author**: David Dorsey, Splunk - **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -90,10 +103,10 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `email_attachments_with_lots_of_spaces_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ None at this time #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md index d9390f2ebf..6b8f834709 100644 --- a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md +++ b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md @@ -24,32 +24,39 @@ This search allows you to look for evidence of exploitation for CVE-2016-4859, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2017-09-19 - **Author**: Bhavin Patel, Splunk - **ID**: d199fb99-2312-451a-9daa-e5efa6ed76a7 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * ID.RA * RS.MI * PR.PT @@ -59,28 +66,34 @@ This search allows you to look for evidence of exploitation for CVE-2016-4859, t +
CIS20 +
+ * CIS 3 * CIS 4 * CIS 18 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 | +
#### Search @@ -93,7 +106,7 @@ index=_internal sourcetype=splunk_web_access return_to="/%09/*" #### Macros The SPL above uses the following Macros: -Note that `open_redirect_in_splunk_web_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -122,7 +135,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index 7fc6ddc4fb..cff978ec0b 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -32,17 +32,18 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2017-09-20 - **Author**: Bhavin Patel, Splunk - **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,44 +51,56 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS | [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.AE * PR.IP +
CIS20 +
+ * CIS 11 * CIS 12 +
CVE +
+
#### Search @@ -104,7 +117,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `large_volume_of_dns_any_queries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 3b59dfe310..4598b7b4fb 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -29,53 +29,66 @@ This search looks for specific GET or HEAD requests to web servers that are indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2017-09-23 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499e-9719-17243f982681 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ This search looks for specific GET or HEAD requests to web servers that are indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 5b415806f9..c015834cab 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -26,32 +26,39 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2017-09-23 - **Author**: Bhavin Patel, Splunk - **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * ID.RA * PR.PT * PR.IP @@ -61,24 +68,30 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con +
CIS20 +
+ * CIS 12 * CIS 4 * CIS 18 +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_malicious_requests_to_exploit_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ No known false positives for this detection. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index e15a27bcd7..163e5617e9 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -24,49 +24,62 @@ This search looks for DNS requests for faux domains similar to the domains that - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2017-09-23 - **Author**: David Dorsey, Splunk - **ID**: 24dd17b1-e2fb-4c31-878c-d4f746595bfa -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -82,11 +95,11 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -115,7 +128,7 @@ None at this time #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index 24bc826490..42458bb78a 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -26,52 +26,65 @@ This search looks for Web requests to faux domains similar to the one that you w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2017-09-23 - **Author**: David Dorsey, Splunk - **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -87,11 +100,11 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -122,7 +135,7 @@ None at this time #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index b0da3f1576..a13423589a 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -25,32 +25,39 @@ This search looks for unusually long strings in the Content-Type http header tha - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2017-10-13 - **Author**: Bhavin Patel, Splunk - **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * ID.RA * RS.MI * PR.PT @@ -61,11 +68,14 @@ This search looks for unusually long strings in the Content-Type http header tha +
CIS20 +
+ * CIS 3 * CIS 4 * CIS 18 @@ -73,13 +83,16 @@ This search looks for unusually long strings in the Content-Type http header tha +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This search looks for unusually long strings in the Content-Type http header tha The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that `unusually_long_content-type_length_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Very few legitimate Content-Type fields will have a length greater than 100 char #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index c24faadc83..d16ce4afab 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -24,54 +24,67 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change_Analysis](https://docs.splunk.com/Documentation/CIM/latest/User/ChangeAnalysis) - - **Last Updated**: 2017-11-27 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499f-9719-17a43f9826f5 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * PR.PT * PR.DS +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_usb_device_insertion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ Legitimate USB activity will also be detected. Please verify and investigate as #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index 17da40420f..10efb31fcf 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -26,52 +26,65 @@ This search looks for emails claiming to be sent from a domain similar to one th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) - - **Last Updated**: 2018-01-05 - **Author**: David Dorsey, Splunk - **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -92,10 +105,10 @@ This search looks for emails claiming to be sent from a domain similar to one th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `monitor_email_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -133,7 +146,7 @@ None at this time #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index 33891eab30..e6310902ca 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -26,58 +26,71 @@ This search looks for AWS CloudTrail events where an instance is started in a pa - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-02-23 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362d6fd75 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 12 +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ec2_instance_started_in_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ It's possible that a user has unknowingly started an instance in a new region. P #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index ea0058e45b..9739a63334 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -23,52 +23,65 @@ This search looks for EC2 instances being created with previously unseen AMIs. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-03-12 - **Author**: David Dorsey, Splunk - **ID**: 347ec301-601b-48b9-81aa-9ddf9c829dd3 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -96,7 +109,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ec2_instance_started_with_previously_unseen_ami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ After a new AMI is created, the first systems created with that AMI will cause t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md index e9cf9a497e..da281b271a 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md @@ -26,57 +26,70 @@ This search looks for AWS provisioning activities from previously unseen cities. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 344a1778-0b25-490c-adb1-de8beddf59cd -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen cities. The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_cloud_provisioning_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md index 5d8064e0de..6079115060 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md @@ -26,57 +26,70 @@ This search looks for AWS provisioning activities from previously unseen countri - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen countri The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_cloud_provisioning_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md index 64ca329130..216a5218a3 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md @@ -23,52 +23,65 @@ This search looks for AWS provisioning activities from previously unseen IP addr - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 42e15012-ac14-4801-94f4-f1acbe64880b -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -95,7 +108,7 @@ This search looks for AWS provisioning activities from previously unseen IP addr The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_cloud_provisioning_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,7 +140,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md index ac468ec665..8b859f1f81 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md @@ -26,57 +26,70 @@ This search looks for AWS provisioning activities from previously unseen regions - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 7971d3df-da82-4648-a6e5-b5637bea5253 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen regions The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_cloud_provisioning_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index 17296e6db7..316f2aeec1 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -29,57 +29,70 @@ This search detects new API calls that have either never been seen before or tha - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-04-16 - **Author**: Bhavin Patel, Splunk - **ID**: 22773e84-bac0-4595-b086-20d3f335b4f1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_api_calls_from_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -146,7 +159,7 @@ It is possible that there are legitimate user roles making new or infrequently u #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index 6ef4d0e767..d095fbfb1e 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -29,59 +29,72 @@ This search will detect users creating spikes in API activity related to securit - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-04-18 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f1-e32372d4bd53 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -111,10 +124,10 @@ This search will detect users creating spikes in API activity related to securit #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -150,7 +163,7 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index eed39525a1..8e50157999 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -25,55 +25,68 @@ This search will detect spike in blocked outbound network connections originatin - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-05-07 - **Author**: Bhavin Patel, Splunk - **ID**: d3fffa37-492f-487b-a35d-c60fcb2acf01 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives * Command & Control +
NIST +
+ * DE.AE * DE.CM * PR.AC +
CIS20 +
+ * CIS 11 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This search will detect spike in blocked outbound network connections originatin The SPL above uses the following Macros: * [cloudwatchlogs_vpcflow](https://github.com/splunk/security_content/blob/develop/macros/cloudwatchlogs_vpcflow.yml) -Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -142,7 +155,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index 87272f8251..545f923c77 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -23,53 +23,66 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-05-17 - **Author**: Bhavin Patel, Splunk - **ID**: 4d46e8bd-4072-48e4-92db-0325889ef894 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.DP * PR.AC +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -91,7 +104,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_api_activity_from_users_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -136,7 +149,7 @@ Many service accounts configured within an AWS infrastructure do not have multi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index 7c15861863..1fc97ee6db 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -26,60 +26,73 @@ This search will detect users creating spikes in API activity related to network - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-05-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a1f1-e32372d4bd53 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 12 * CIS 11 +
CVE +
+
#### Search @@ -109,10 +122,10 @@ This search will detect users creating spikes in API activity related to network #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `detect_spike_in_network_acl_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -148,7 +161,7 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index 2cf421aa46..4d59c747a4 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -29,58 +29,71 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2018-06-01 - **Author**: Rico Valdez, Splunk - **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * DE.AE +
CIS20 +
+ * CIS 9 * CIS 12 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_large_outbound_icmp_packets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md index 61186d4d10..b2abb45daf 100644 --- a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md +++ b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md @@ -24,32 +24,39 @@ This search allows you to look for evidence of exploitation for CVE-2018-11409, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-06-14 - **Author**: David Dorsey, Splunk - **ID**: f6a26b7b-7e80-4963-a9a8-d836e7534ebd -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * ID.RA * RS.MI * PR.PT @@ -59,28 +66,34 @@ This search allows you to look for evidence of exploitation for CVE-2018-11409, +
CIS20 +
+ * CIS 3 * CIS 4 * CIS 18 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 | +
#### Search @@ -99,7 +112,7 @@ index=_internal sourcetype=splunkd_ui_access server-info The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `splunk_enterprise_information_disclosure_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Retrieving server information may be a legitimate API request. Verify that the a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 15b1199f60..7d801f8b3a 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -28,60 +28,73 @@ This search looks at S3 bucket-access logs and detects new or previously unseen - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-06-28 - **Author**: Bhavin Patel, Splunk - **ID**: e6f1bb1b-f441-492b-9126-902acda217da -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 * CIS 14 +
CVE +
+
#### Search @@ -105,10 +118,10 @@ This search looks at S3 bucket-access logs and detects new or previously unseen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_s3_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md index b05285b9a4..b389b435ad 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md +++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md @@ -26,58 +26,71 @@ This search is used to identify the creation of multiple user accounts using the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: bf1d7b5c-df2f-4249-a401-c09fdc221ddf -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM * DE.DP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ This search is used to identify the creation of multiple user accounts using the The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that `web_fraud_-_account_harvesting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ As is common with many fraud-related searches, we are usually looking to attribu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md index ab46686c82..2f2bca0560 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md +++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md @@ -29,58 +29,71 @@ This search is used to examine web sessions to identify those where the clicks a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: 31337bbb-bc22-4752-b599-ef192df2dc7a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ * CIS 6 +
CVE +
+
#### Search @@ -99,7 +112,7 @@ This search is used to examine web sessions to identify those where the clicks a The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that `web_fraud_-_anomalous_user_clickspeed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ As is common with many fraud-related searches, we are usually looking to attribu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md index f697811be7..796dc22bfa 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md +++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md @@ -23,52 +23,65 @@ This search is used to identify user accounts that share a common password. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: 31337a1a-53b9-4e05-96e9-55c934cb71d3 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.DP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -88,7 +101,7 @@ This search is used to identify user accounts that share a common password. The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) -Note that `web_fraud_-_password_sharing_across_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ As is common with many fraud-related searches, we are usually looking to attribu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index 318fca7454..9eeb18973e 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -23,53 +23,66 @@ This search looks for cloud compute instances being created with previously unse - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2018-10-12 - **Author**: David Dorsey, Splunk - **ID**: bc24922d-987c-4645-b288-f8c73ec194c4 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -94,7 +107,7 @@ This search looks for cloud compute instances being created with previously unse The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_compute_instance_created_with_previously_unseen_image_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -132,7 +145,7 @@ After a new image is created, the first systems created with that image will cau #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index ac387312e7..fb2f3b310d 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -28,37 +28,44 @@ This search looks for the creation of WMI permanent event subscriptions. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-10-23 - **Author**: Rico Valdez, Splunk - **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -66,23 +73,29 @@ This search looks for the creation of WMI permanent event subscriptions. +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) -Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index ec634ff160..f7858e136a 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -28,37 +28,44 @@ This search looks for the creation of WMI temporary event subscriptions. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-10-23 - **Author**: Rico Valdez, Splunk - **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -66,23 +73,29 @@ This search looks for the creation of WMI temporary event subscriptions. +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) -Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Some software may create WMI temporary event subscriptions for various purposes. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index c214720848..4bde8d2248 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -23,32 +23,39 @@ The search looks for modifications to the hosts file on all Windows endpoints ac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-11-02 - **Author**: Rico Valdez, Splunk - **ID**: 06a6fc63-a72d-41dc-8736-7e3dd9612116 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.IP * PR.PT * PR.AC @@ -57,24 +64,30 @@ The search looks for modifications to the hosts file on all Windows endpoints ac +
CIS20 +
+ * CIS 3 * CIS 8 * CIS 12 +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The search looks for modifications to the hosts file on all Windows endpoints ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_hosts_file_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ There may be legitimate reasons for system administrators to add entries to this #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index cad3d0e675..de15d459ff 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -28,59 +28,72 @@ This search detects users creating spikes in API activity related to deletion of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-11-27 - **Author**: Bhavin Patel, Splunk - **ID**: e733a326-59d2-446d-b8db-14a17151aa68 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -113,7 +126,7 @@ This search detects users creating spikes in API activity related to deletion of The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -150,7 +163,7 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 77906cce4b..ecd91f468b 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -26,38 +26,45 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-03 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -65,23 +72,29 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -97,11 +110,11 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 157de743a6..4edf3cf3c7 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -26,38 +26,45 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-03 - **Author**: David Dorsey, Splunk - **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM * PR.PT * DE.AE @@ -66,24 +73,30 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks +
CIS20 +
+ * CIS 6 * CIS 8 * CIS 10 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `usn_journal_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index 13fcee1f51..2d8d893263 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -25,53 +25,66 @@ This search looks for suspicious Java classes that are often used to exploit rem - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2018-12-06 - **Author**: Jose Hernandez, Splunk - **ID**: 6ed33786-5e87-4f55-b62c-cb5f1168b831 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.AE +
CIS20 +
+ * CIS 7 * CIS 12 +
CVE +
+
#### Search @@ -92,7 +105,7 @@ The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_java_classes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ There are no known false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index 6392041f4b..56efa8a693 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -23,54 +23,67 @@ The search looks for file writes with extensions consistent with a SamSam ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-14 - **Author**: Rico Valdez, Splunk - **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -88,10 +101,10 @@ The search looks for file writes with extensions consistent with a SamSam ransom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `file_with_samsam_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -124,7 +137,7 @@ Because these extensions are not typically used in normal operations, you should #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index d49ca96936..2a52f177ee 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -26,59 +26,72 @@ The search looks for a file named "test.txt" written to the windows system direc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-14 - **Author**: Rico Valdez, Splunk - **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The search looks for a file named "test.txt" written to the windows system direc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `samsam_test_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ No false positives have been identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index db15a4bf93..bf708c145b 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -25,53 +25,66 @@ This search looks for processes in an MacOS system that is tapping keyboard even - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-01-25 - **Author**: Jose Hernandez, Splunk - **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * DE.DP +
CIS20 +
+ * CIS 4 * CIS 8 +
CVE +
+
#### Search @@ -89,7 +102,7 @@ This search looks for processes in an MacOS system that is tapping keyboard even #### Macros The SPL above uses the following Macros: -Note that `processes_tapping_keyboard_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -124,7 +137,7 @@ There might be some false positives as keyboard event taps are used by processes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md index 6e4031575a..4ffdd99b1a 100644 --- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md +++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md @@ -23,56 +23,69 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-01-29 - **Author**: Rico Valdez, Splunk - **ID**: a6fffe5e-05c3-4c04-badc-887607fbb8dc -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation * Command & Control +
NIST +
+ * DE.DP * DE.CM * PR.PT +
CIS20 +
+ * CIS 4 * CIS 8 +
CVE +
+
#### Search @@ -90,7 +103,7 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. #### Macros The SPL above uses the following Macros: -Note that `osquery_pack_-_coldroot_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,7 +132,7 @@ There are no known false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 8cfa96173d..98c8b113a5 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -26,61 +26,74 @@ This search looks for PowerShell requesting privileges consistent with credentia - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-02-27 - **Author**: Rico Valdez, Splunk - **ID**: 98917be2-bfc8-475a-8618-a9bb06575188 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP * PR.AC * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_mimikatz_via_powershell_and_eventcode_4703_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ The activity may be legitimate. PowerShell is often used by administrators to pe #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index ce9d4b1b7e..327f63ad93 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -27,57 +27,70 @@ The search looks for command-line arguments used to hide a file or directory usi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2019-02-27 - **Author**: Bhavin Patel, Splunk - **ID**: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The search looks for command-line arguments used to hide a file or directory usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ None at the moment #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 352b1f4b11..26bd210d99 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -29,57 +29,70 @@ This search looks for suspicious processes on all systems labeled as web servers - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2019-04-01 - **Author**: David Dorsey, Splunk - **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search looks for suspicious processes on all systems labeled as web servers #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `web_servers_executing_suspicious_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Some of these processes may be used legitimately on web servers during maintenan #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index c086acc749..77da09a603 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -23,53 +23,66 @@ The search looks for files created with names that have been linked to malicious - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-04-25 - **Author**: Rico Valdez, Splunk - **ID**: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,7 +132,7 @@ It's possible for a legitimate file to be created with the same name as one note #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index 103edb8dbc..a0131a1d50 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -25,53 +25,66 @@ Command lines that are extremely long may be indicative of malicious activity on - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-05-08 - **Author**: Rico Valdez, Splunk - **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unusually_long_command_line_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Some legitimate applications use long command lines for installs or updates. You #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 0b7172275b..d30c59de5e 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -24,55 +24,68 @@ This search looks for applications on the endpoint that you have marked as prohi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2019-10-11 - **Author**: David Dorsey, Splunk - **ID**: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation * Command & Control * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 2 +
CVE +
+
#### Search @@ -89,11 +102,11 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _times @@ -124,7 +137,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 6f87a3c1e1..c54433e48d 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -29,17 +29,18 @@ This search looks for reading lsass memory consistent with credential dumping. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-12-03 - **Author**: Patrick Bareiss, Splunk - **ID**: 2c365e57-4414-4540-8dc0-73ab10729996 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,45 +48,57 @@ This search looks for reading lsass memory consistent with credential dumping. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP * PR.AC * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for reading lsass memory consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_credential_dumping_through_lsass_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index de1d21e440..b0ba58deb9 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -29,17 +29,18 @@ This search looks for reading loaded Images unique to credential dumping with Mi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-12-03 - **Author**: Patrick Bareiss, Splunk - **ID**: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for reading loaded Images unique to credential dumping with Mi | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for reading loaded Images unique to credential dumping with Mi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_mimikatz_using_loaded_images_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index ba292df1ed..19c8bc230a 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -29,17 +29,18 @@ Detect memory dumping of the LSASS process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ Detect memory dumping of the LSASS process. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ Detect memory dumping of the LSASS process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `access_lsass_memory_for_dump_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index b3dbd66e94..5946b6f4b2 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -29,17 +29,18 @@ Detect remote thread creation into LSASS consistent with credential dumping. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 67d4dbef-9564-4699-8da8-03a151529edc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ Detect remote thread creation into LSASS consistent with credential dumping. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ Detect remote thread creation into LSASS consistent with credential dumping. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `create_remote_thread_into_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index bfa1492924..38606d00cd 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -26,58 +26,71 @@ This search detects loading of unsigned images by LSASS. Deprecated because too - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 56ef054c-76ef-45f9-af4a-a634695dcd65 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search detects loading of unsigned images by LSASS. Deprecated because too #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unsigned_image_loaded_by_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index e897c0b0e9..5470d7ae6e 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -29,18 +29,19 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2019-12-10 - **Author**: Patrick Bareiss, Splunk - **ID**: eb120f5f-b879-4a63-97c1-93352b5df844 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `creation_of_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 8c19d251ff..a04f40c20d 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -32,17 +32,18 @@ This search allows you to identify DNS requests that are unusually large for the - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-01-22 - **Author**: Rico Valdez, Splunk - **ID**: 85fbcfe8-9718-4911-adf6-7000d077a3a9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,44 +51,56 @@ This search allows you to identify DNS requests that are unusually large for the | [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.PT * DE.AE * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 +
CVE +
+
#### Search @@ -110,10 +123,10 @@ This search allows you to identify DNS requests that are unusually large for the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dns_query_length_outliers_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,7 +167,7 @@ If you are seeing more results than desired, you may consider reducing the value #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md index 3649e66c3c..529bd4b719 100644 --- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md @@ -29,18 +29,19 @@ this search is to detect a suspicious registry modification to implement auto ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to detect a suspicious registry modification to implement auto ad | [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to detect a suspicious registry modification to implement auto ad The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `auto_admin_logon_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **auto_admin_logon_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md index da63851012..406eda1059 100644 --- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md @@ -31,17 +31,18 @@ This search looks for registry activity associated with modifications to the reg - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-01-28 - **Author**: Bhavin Patel, Teoderick Contreras, Splunk - **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,44 +50,56 @@ This search looks for registry activity associated with modifications to the reg | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.AC +
CIS20 +
+ * CIS 8 * CIS 5 +
CVE +
+
#### Search @@ -109,7 +122,7 @@ This search looks for registry activity associated with modifications to the reg The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `monitor_registry_keys_for_print_monitors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **monitor_registry_keys_for_print_monitors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ You will encounter noise from legitimate print-monitor registry entries. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md index b3a8d1e4df..95b88ef8c3 100644 --- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md @@ -31,17 +31,18 @@ This search looks for registry activity associated with application compatibilit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-01-28 - **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,42 +50,54 @@ This search looks for registry activity associated with application compatibilit | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ This search looks for registry activity associated with application compatibilit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `registry_keys_for_creating_shim_databases_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **registry_keys_for_creating_shim_databases_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ There are many legitimate applications that leverage shim databases for compatib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md index ee7ceb6e00..0da7afdf14 100644 --- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md +++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md @@ -31,18 +31,19 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: d71efbf6-da63-11eb-8c6e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `sdclt_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sdclt_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Limited to no false positives are expected. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md index 39faaa6c9c..26365b0642 100644 --- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md +++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md @@ -31,18 +31,19 @@ This search is to detect a suspicious modification of registry that may related - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a suspicious modification of registry that may related | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search is to detect a suspicious modification of registry that may related The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `silentcleanup_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **silentcleanup_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md index efc61d06cd..a98f2c7b45 100644 --- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md +++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md @@ -31,18 +31,19 @@ This search is to detect a suspicious modification of registry related to UAC by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 8b5901bc-da63-11eb-be43-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a suspicious modification of registry related to UAC by | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search is to detect a suspicious modification of registry related to UAC by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `wsreset_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wsreset_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index 54a867b304..a964f7ba27 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -29,17 +29,18 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-02-03 - **Author**: Michael Haag, Splunk - **ID**: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `creation_of_lsass_dump_with_taskmgr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 1021b6a974..3d6d3bd303 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -23,52 +23,65 @@ This search looks for EC2 instances being created with previously unseen instanc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-02-07 - **Author**: David Dorsey, Splunk - **ID**: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ec2_instance_started_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ It is possible that an admin will create a new system using a new instance type #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 77a29ec12a..1a734ea018 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -26,54 +26,67 @@ This search looks for processes referencing the plist files that determine which - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-02-07 - **Author**: Jamie Windley, Splunk - **ID**: 40bb64f9-f619-4e3d-8732-328d40377c4b -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation * Command & Control +
NIST +
+ * DE.DP * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search looks for processes referencing the plist files that determine which #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `macos_-_re-opened_applications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,7 +140,7 @@ At this stage, there are no known false positives. During testing, no process ev #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md index c31a37464a..d251cde26f 100644 --- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md +++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md @@ -26,53 +26,66 @@ This search show information on uploaded containers including source user, accou - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-02-20 - **Author**: Rod Soto, Rico Valdez, Splunk - **ID**: 4f00ca88-e766-4605-ac65-ae51c9fd185b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,7 +100,7 @@ This search show information on uploaded containers including source user, accou #### Macros The SPL above uses the following Macros: -Note that `gcp_gcr_container_uploaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_gcr_container_uploaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -116,7 +129,7 @@ Uploading container is a normal behavior from developers or users with access to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index e55f7a4706..95bc2d5e79 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -28,53 +28,66 @@ This searches show information on uploaded containers including source user, ima - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-02-20 - **Author**: Rod Soto, Rico Valdez, Splunk - **ID**: f0f70b40-f7ad-489d-9905-23d149da8099 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,7 +102,7 @@ This searches show information on uploaded containers including source user, ima #### Macros The SPL above uses the following Macros: -Note that `new_container_uploaded_to_aws_ecr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **new_container_uploaded_to_aws_ecr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,7 +131,7 @@ Uploading container is a normal behavior from developers or users with access to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index af5fac2afd..08c7ff195d 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -29,18 +29,19 @@ Detect the usage of comsvcs.dll for dumping the lsass process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-02-21 - **Author**: Patrick Bareiss, Splunk - **ID**: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ Detect the usage of comsvcs.dll for dumping the lsass process. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index f998161df1..015266cda9 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -23,53 +23,66 @@ This search monitors for remote modifications to registry keys. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-03-02 - **Author**: Bhavin Patel, Splunk - **ID**: c9f4b923-f8af-4155-b697-1354f5dcbc5e -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -85,10 +98,10 @@ This search monitors for remote modifications to registry keys. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_registry_key_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -119,7 +132,7 @@ This technique may be legitimately used by administrators to modify remote regis #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index 9b07c2df96..4261c35303 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -30,64 +30,77 @@ This search looks for child processes of spoolsv.exe. This activity is associate - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Splunk - **ID**: aa0c4aeb-5b18-41c4-8c07-f1442d7599df -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.AC * PR.PT * DE.CM +
CIS20 +
+ * CIS 5 * CIS 8 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 | +
#### Search @@ -103,10 +116,10 @@ This search looks for child processes of spoolsv.exe. This activity is associate #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `child_processes_of_spoolsv_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 7e84d1142c..0cb1608fb2 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -26,34 +26,41 @@ This search will return a table of rare processes, the names of the systems runn - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-03-16 - **Author**: Bhavin Patel, Splunk - **ID**: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation * Command & Control * Actions on Objectives +
NIST +
+ * ID.AM * PR.PT * PR.DS @@ -61,23 +68,29 @@ This search will return a table of rare processes, the names of the systems runn +
CIS20 +
+ * CIS 2 * CIS 8 +
CVE +
+
#### Search @@ -100,11 +113,11 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rare_executables_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Some legitimate processes may be only rarely executed in your environment. As th #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 843bd369e6..61227044bb 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -26,38 +26,45 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: 24869767-8579-485d-9a4f-d9ddfd8f0cac -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -65,23 +72,29 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `process_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Although unlikely, administrators may use wmi to execute commands for legitimate #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 48d6886ac1..4e454d0e2d 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -26,38 +26,45 @@ This search looks for scripts launched via WMI. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: aa73f80d-d728-4077-b226-81ea0c8be589 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -65,23 +72,29 @@ This search looks for scripts launched via WMI. +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This search looks for scripts launched via WMI. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `script_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Although unlikely, administrators may use wmi to launch scripts for legitimate p #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 6ba37f9e8f..7ccb65d60b 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -25,52 +25,65 @@ The search looks for a sharp increase in the number of files written to a partic - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-03-16 - **Author**: David Dorsey, Splunk - **ID**: fdb0f805-74e4-4539-8c00-618927333aae -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -90,7 +103,7 @@ The search looks for a sharp increase in the number of files written to a partic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `spike_in_file_writes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spike_in_file_writes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ It is important to understand that if you happen to install any new applications #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 0b359cbc16..661bd66a7c 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -28,53 +28,66 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: 294c4686-63dd-4fe6-93a2-ca807626704a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `amazon_eks_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 69a352d616..a6346aea8f 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -28,53 +28,66 @@ This search provides detection information on unauthenticated requests against K - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This search provides detection information on unauthenticated requests against K #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `amazon_eks_kubernetes_pod_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index 1a3aecac18..62c22beed4 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -26,53 +26,66 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: db5957ec-0144-4c56-b512-9dccbe7a2d26 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gcp_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -121,7 +134,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent and so #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md index 741c714834..0b963258b0 100644 --- a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md +++ b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md @@ -26,53 +26,66 @@ This search provides information of unauthenticated requests via source IP user - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-19 - **Author**: Rod Soto, Splunk - **ID**: c5e5bd5c-1013-4841-8b23-e7b3253c840a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,7 +102,7 @@ This search provides information of unauthenticated requests via source IP user The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_scan_fingerprint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -118,7 +131,7 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index b1529dbf68..df4169f032 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -29,60 +29,73 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-05-20 - **Author**: David Dorsey, Splunk - **ID**: e91bd102-d630-4e76-ab73-7e3ba22c5961 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `first_time_seen_child_process_of_zoom_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -145,7 +158,7 @@ A new child process of zoom isn't malicious by that fact alone. Further investig #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md index 934af4d2c8..38bdffcdc7 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 1bba382b-07fd-4ffa-b390-8002739b76e8 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -82,7 +95,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_detect_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -111,7 +124,7 @@ Sensitive object access is not necessarily malicious but user and object context #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md index 42ccf45bbf..acbec18ca6 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: f27349e5-1641-4f6a-9e68-30402be0ad4c -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -82,7 +95,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -111,7 +124,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md index acfe0c1ff8..7216acca1c 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 019690d7-420f-4da0-b320-f27b09961514 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -81,7 +94,7 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -110,7 +123,7 @@ This search can give false positives as there might be inherent issues with auth #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md index cda72aa75e..d5ba1131e2 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md @@ -23,48 +23,61 @@ This search provides information of unauthenticated requests via source IP user - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 86aad3e0-732f-4f66-bbbc-70df448e461d -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -81,7 +94,7 @@ This search provides information of unauthenticated requests via source IP user The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_pod_scan_fingerprint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_pod_scan_fingerprint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -110,7 +123,7 @@ Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md index d9d071cea0..dd121a91cf 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts,accessing pods a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-26 - **Author**: Rod Soto, Splunk - **ID**: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -82,7 +95,7 @@ This search provides information on Kubernetes service accounts,accessing pods a The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_active_service_accounts_by_pod_namespace_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_active_service_accounts_by_pod_namespace_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -111,7 +124,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP an #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md index 0bb5475cba..3a8806a65a 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-26 - **Author**: Rod Soto, Splunk - **ID**: 47af7d20-0607-4079-97d7-7a29af58b54e -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -83,7 +96,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_detect_rbac_authorization_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -112,7 +125,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md index 4244ae7c8c..c251aa428b 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md @@ -23,48 +23,61 @@ This search provides information on rare Kubectl calls with IP, verb namespace a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-05-26 - **Author**: Rod Soto, Splunk - **ID**: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -83,7 +96,7 @@ This search provides information on rare Kubectl calls with IP, verb namespace a The SPL above uses the following Macros: * [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) -Note that `kubernetes_azure_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_azure_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -112,7 +125,7 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index e3531b2f70..7c7c74b4bb 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -24,54 +24,67 @@ This search looks for AssumeRole events where an IAM role in a different account - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2020-05-28 - **Author**: Rico Valdez, Splunk - **ID**: 21193641-cb96-4a2c-a707-d9b9a7f7792b -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.AC * PR.DS * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -95,7 +108,7 @@ This search looks for AssumeRole events where an IAM role in a different account The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_cross_account_activity_from_previously_unseen_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_cross_account_activity_from_previously_unseen_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -134,7 +147,7 @@ Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicio #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md index 415460f3a7..30b0dc8279 100644 --- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md @@ -24,53 +24,66 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2020-05-28 - **Author**: Rico Valdez, Splunk - **ID**: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_aws_console_login_by_new_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_aws_console_login_by_new_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -128,7 +141,7 @@ When a legitimate new user logins for the first time, this activity will be dete #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md index 349ab7040c..b1337093ea 100644 --- a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md +++ b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 7f227943-2196-4d4d-8d6a-ac8cb308e61c -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `aws_eks_kubernetes_cluster_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_eks_kubernetes_cluster_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Sensitive object access is not necessarily malicious but user and object context #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md index 04a66c11f7..55ea636b39 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts,accessing pods b - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes service accounts,accessing pods b The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `kubernetes_aws_detect_most_active_service_accounts_by_pod_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_aws_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md index 941f8d7525..04dc1e5921 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -81,7 +94,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `kubernetes_aws_detect_rbac_authorization_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_aws_detect_rbac_authorization_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -110,7 +123,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md index e65c984c46..69f30eb677 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: b6013a7b-85e0-4a45-b051-10b252d69569 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `kubernetes_aws_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_aws_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md index 60de9c5440..f25271fbc8 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: a6959c57-fa8f-4277-bb86-7c32fba579d5 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -79,7 +92,7 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -108,7 +121,7 @@ This search can give false positives as there might be inherent issues with auth #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 5d334e6209..cc32b964f1 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -25,48 +25,61 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 042a3d32-8318-4763-9679-09db2644a8f2 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -82,7 +95,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `kubernetes_aws_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_aws_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -117,7 +130,7 @@ Kubectl calls are not malicious by nature. However source IP, verb and Object ca #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md index 0864df6dff..788220f545 100644 --- a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 7094808d-432a-48e7-bb3c-77e96c894f3b -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes service accounts with failure or The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ This search can give false positives as there might be inherent issues with auth #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index a4fd780038..c6f67e1323 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -33,18 +33,19 @@ The detection Detect Path Interception By Creation Of program exe is detecting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-03 - **Author**: Patrick Bareiss, Splunk - **ID**: cbef820c-e1ff-407f-887f-0a9240a2d477 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,42 +53,54 @@ The detection Detect Path Interception By Creation Of program exe is detecting t | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -110,10 +123,10 @@ The detection Detect Path Interception By Creation Of program exe is detecting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_path_interception_by_creation_of_program_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,7 +169,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index 89d7572351..c53a4ec86a 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -30,17 +30,18 @@ This search detects accounts that were created and deleted in a short time perio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) - - **Last Updated**: 2020-07-06 - **Author**: David Dorsey, Splunk - **ID**: b25f6f62-0782-43c1-b403-083231ffd97d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,41 +49,53 @@ This search detects accounts that were created and deleted in a short time perio | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search detects accounts that were created and deleted in a short time perio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `short_lived_windows_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ It is possible that an administrator created and deleted an account in a short t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index d5ea7782cc..5fe6fe26ad 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -29,17 +29,18 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-06 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: ad517544-aff9-4c96-bd99-d6eb43bfbb6a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,21 +48,27 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * PR.IP * PR.AC @@ -70,24 +77,30 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 6 +
CVE +
+
#### Search @@ -103,10 +116,10 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_event_log_cleared_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ It is possible that these logs may be legitimately cleared by Administrators. Fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 35f9e21d23..2eb14ff048 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -32,17 +32,18 @@ This search looks for network traffic on TCP/3389, the default port used by remo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-07 - **Author**: David Dorsey, Splunk - **ID**: 272b8407-842d-4b3d-bead-a704584003d3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,45 +51,57 @@ This search looks for network traffic on TCP/3389, the default port used by remo | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * PR.AC * PR.IP +
CIS20 +
+ * CIS 3 * CIS 9 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This search looks for network traffic on TCP/3389, the default port used by remo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_desktop_network_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Remote Desktop may be used legitimately by users on the network. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index ce73add29f..052f8233cd 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -29,17 +29,18 @@ This search looks for newly created accounts that have been elevated to local ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-08 - **Author**: David Dorsey, Splunk - **ID**: b25f6f62-0712-43c1-b203-083231ffd97d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for newly created accounts that have been elevated to local ad | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives * Command & Control +
NIST +
+ * PR.AC * DE.CM +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_local_admin_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ The activity may be legitimate. For this reason, it's best to verify the account #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md index cd866dae5d..67e134b92b 100644 --- a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes service accounts,accessing pods b - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-10 - **Author**: Rod Soto, Splunk - **ID**: 7f5c2779-88a0-4824-9caa-0f606c8f260f -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes service accounts,accessing pods b The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Not all service accounts interactions are malicious. Analyst must consider IP, v #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md index f2a7b009de..6082cd709b 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: 99487de3-7192-4b41-939d-fbe9acfb1340 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes RBAC authorizations by accounts, The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_rbac_authorizations_by_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_rbac_authorizations_by_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Not all RBAC Authorications are malicious. RBAC authorizations can uncover malic #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md index e3f4c47629..5103eaf88e 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: bdb6d596-86a0-4aba-8369-418ae8b9963a -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_sensitive_object_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_sensitive_object_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Sensitive object access is not necessarily malicious but user and object context #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md index c0bcf969e2..28918e2e81 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md @@ -23,48 +23,61 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: a46923f6-36b9-4806-a681-31f314907c30 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on Kubernetes accounts accessing sensitve objec The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_sensitive_role_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_sensitive_role_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Sensitive role resource access is necessary for cluster operation, however sourc #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md index a888ee8485..b56454d131 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md @@ -23,48 +23,61 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: a5bed417-070a-41f2-a1e4-82b6aa281557 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,7 +93,7 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `kubernetes_gcp_detect_suspicious_kubectl_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_gcp_detect_suspicious_kubectl_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -109,7 +122,7 @@ Kubectl calls are not malicious by nature. However source IP, source user, user #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index b11f6a74b7..41ae84659d 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -28,53 +28,66 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-17 - **Author**: Rod Soto, Splunk - **ID**: 19b53215-4a16-405b-8087-9e6acf619842 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,7 +104,7 @@ This search provides information of unauthenticated requests via user agent, and The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `gcp_kubernetes_cluster_pod_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_kubernetes_cluster_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md index 056dcab33e..1509071b4b 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md @@ -29,58 +29,71 @@ This search looks for AWS CloudTrail events where a user successfully launches a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `abnormally_high_aws_instances_launched_by_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_aws_instances_launched_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md index b1af5e1fee..d421f248a0 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md @@ -29,58 +29,71 @@ This search looks for AWS CloudTrail events where a user successfully launches a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Jason Brewer, Splunk - **ID**: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ This search looks for AWS CloudTrail events where a user successfully launches a The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `abnormally_high_aws_instances_launched_by_user_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_aws_instances_launched_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md index a163d94b7c..bf95af286e 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md @@ -29,58 +29,71 @@ This search looks for AWS CloudTrail events where an abnormally high number of i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 8d301246-fccf-45e2-a8e7-3655fd14379c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This search looks for AWS CloudTrail events where an abnormally high number of i The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `abnormally_high_aws_instances_terminated_by_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_aws_instances_terminated_by_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Many service accounts configured with your AWS infrastructure are known to exhib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md index 8c7558e643..234156fdbb 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md @@ -29,58 +29,71 @@ This search looks for AWS CloudTrail events where a user successfully terminates - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Jason Brewer, Splunk - **ID**: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ This search looks for AWS CloudTrail events where a user successfully terminates The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `abnormally_high_aws_instances_terminated_by_user_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_aws_instances_terminated_by_user_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index ab46dd998d..a246fb3df8 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -29,18 +29,19 @@ This search looks for attempts to stop security-related services on the endpoint - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,46 +49,58 @@ This search looks for attempts to stop security-related services on the endpoint | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 8 +
CVE +
+
#### Search @@ -106,10 +119,10 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `attempt_to_stop_security_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -160,7 +173,7 @@ None identified. Attempts to disable security-related services should be identif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md index 76b5e58b18..3658556087 100644 --- a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md +++ b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md @@ -27,61 +27,74 @@ This search allows you to identify the endpoints that have connected to more tha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 74ec6f18-604b-4202-a567-86b2066be3ce -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.PT * DE.AE * PR.DS +
CIS20 +
+ * CIS 9 * CIS 12 * CIS 13 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ This search allows you to identify the endpoints that have connected to more tha The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `clients_connecting_to_multiple_dns_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **clients_connecting_to_multiple_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ It's possible that an enterprise has more than five DNS servers that are configu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index d030b3e243..6060e39577 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -29,37 +29,44 @@ This search looks for successful AWS CloudTrail activity by user accounts that a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d4bd55 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC @@ -67,22 +74,28 @@ This search looks for successful AWS CloudTrail activity by user accounts that a +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_aws_api_activities_from_unapproved_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -152,7 +165,7 @@ It's likely that you'll find activity detected by users/service accounts that ar #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index e0d7c349b5..f4a0fbee56 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -27,38 +27,45 @@ This search looks for DNS requests for phishing domains that are leveraging Evil - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 24dd17b1-e2fb-4c31-878c-d4f226595bfa -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1566.003](https://attack.mitre.org/techniques/T1566/003/) | Spearphishing via Service | Initial Access | +
Kill Chain Phase +
+ * Delivery * Command & Control +
NIST +
+ * ID.AM * PR.DS * PR.IP @@ -67,23 +74,29 @@ This search looks for DNS requests for phishing domains that are leveraging Evil +
CIS20 +
+ * CIS 8 * CIS 7 +
CVE +
+
#### Search @@ -110,16 +123,16 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: +* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) * [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) -* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -Note that `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,7 +170,7 @@ If a known good domain is not listed in the legit_domains.csv file, then the sea #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index 2b79cfc608..b18dc909c4 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -36,17 +36,18 @@ This search detects user accounts that have been locked out a relatively high nu - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 95a7f9a5-6096-437e-a19e-86f42ac609bd -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,41 +55,53 @@ This search detects user accounts that have been locked out a relatively high nu | [T1078.003](https://attack.mitre.org/techniques/T1078/003/) | Local Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,10 +119,10 @@ This search detects user accounts that have been locked out a relatively high nu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_excessive_user_account_lockouts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ It is possible that a legitimate user is experiencing an issue causing multiple #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index 733bf35414..6e06cf8484 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -27,37 +27,44 @@ This search is used to detect attempts to use DNS tunneling, by calculating the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 05437c07-62f5-452e-afdc-04dd44815bb9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.DS * PR.PT * DE.AE @@ -65,24 +72,30 @@ This search is used to detect attempts to use DNS tunneling, by calculating the +
CIS20 +
+ * CIS 8 * CIS 12 * CIS 13 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This search is used to detect attempts to use DNS tunneling, by calculating the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_long_dns_txt_record_response_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It's possible that legitimate TXT record responses can be long enough to trigger #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index 516b3891c2..9a11a10b9e 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -29,58 +29,71 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ When a legitimate new user logins for the first time, this activity will be dete #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 9750765267..912387e432 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -32,17 +32,18 @@ This search looks for outbound SMB connections made by hosts within your network - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Stuart Hopkins from Splunk - **ID**: 1bed7774-304a-4e8f-9d72-d80e45ff492b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,42 +51,54 @@ This search looks for outbound SMB connections made by hosts within your network | [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | +
Kill Chain Phase +
+ * Actions on Objectives * Command & Control +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 12 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for outbound SMB connections made by hosts within your network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_outbound_smb_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ It is likely that the outbound Server Message Block (SMB) traffic is legitimate, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 5b229c5dc3..8dc1096616 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -31,17 +31,18 @@ This search looks for execution of process `outlook.exe` where the process is wr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-4822-b1e4-16ae10145893 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,44 +50,56 @@ This search looks for execution of process `outlook.exe` where the process is wr | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -113,10 +126,10 @@ This search looks for execution of process `outlook.exe` where the process is wr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_outlook_exe_writing_a_zip_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ It is not uncommon for outlook to write legitimate zip files to the disk. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md index 0a8f81a618..85a7a482f1 100644 --- a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md +++ b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md @@ -29,59 +29,72 @@ This search will detect users creating spikes of API activity in your AWS enviro - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d32362d4bd55 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -113,7 +126,7 @@ This search will detect users creating spikes of API activity in your AWS enviro The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `detect_spike_in_aws_api_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_aws_api_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -156,7 +169,7 @@ Detailed documentation on how to create a new field within Incident Review may b #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 24617bd9ca..f8f3d5e76a 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -29,18 +29,19 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Mauricio Velazco, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162039e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_use_of_cmd_exe_to_launch_script_interpreters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Some legitimate applications may exhibit this behavior. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index b05d3615a5..a09674d9f0 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -27,60 +27,73 @@ This search looks for web connections to dynamic DNS providers. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 134da869-e264-4a8f-8d7e-fcd01c18f301 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.IP * DE.DP +
CIS20 +
+ * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -96,11 +109,11 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_web_traffic_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ It is possible that list of dynamic DNS providers is outdated and/or that the UR #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index fd6bb79266..f57c3c016a 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -30,58 +30,71 @@ This search looks for specific command-line arguments that may indicate the exec - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1072](https://attack.mitre.org/techniques/T1072/) | Software Deployment Tools | Execution, Lateral Movement | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This search looks for specific command-line arguments that may indicate the exec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detection_of_tools_built_by_nirsoft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md index 738d858998..fc3e11fff9 100644 --- a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md +++ b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md @@ -27,37 +27,44 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * ID.AM * PR.DS * PR.IP @@ -66,11 +73,14 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit +
CIS20 +
+ * CIS 1 * CIS 3 * CIS 8 @@ -78,13 +88,16 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit +
CVE +
+
#### Search @@ -100,7 +113,7 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `dns_query_requests_resolved_by_unauthorized_dns_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dns_query_requests_resolved_by_unauthorized_dns_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Legitimate DNS activity can be detected in this search. Investigate, verify and #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-dns_record_changed.md b/docs/_posts/2020-07-21-dns_record_changed.md index 6c6c5662f3..cd248af252 100644 --- a/docs/_posts/2020-07-21-dns_record_changed.md +++ b/docs/_posts/2020-07-21-dns_record_changed.md @@ -27,37 +27,44 @@ The search takes the DNS records and their answers results of the discovered_dns - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: Jose Hernandez, Splunk - **ID**: 44d3a43e-dcd5-49f7-8356-5209bb369065 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1071.004](https://attack.mitre.org/techniques/T1071/004/) | DNS | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * ID.AM * PR.DS * PR.IP @@ -66,11 +73,14 @@ The search takes the DNS records and their answers results of the discovered_dns +
CIS20 +
+ * CIS 1 * CIS 3 * CIS 8 @@ -78,13 +88,16 @@ The search takes the DNS records and their answers results of the discovered_dns +
CVE +
+
#### Search @@ -115,7 +128,7 @@ The search takes the DNS records and their answers results of the discovered_dns The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `dns_record_changed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dns_record_changed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -158,7 +171,7 @@ Legitimate DNS changes can be detected in this search. Investigate, verify and u #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 2a30a8e515..2a3183ad30 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -29,57 +29,70 @@ This search looks for EC2 instances being modified by users who have not previou - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 56f91724-cf3f-4666-84e1-e3712fb41e76 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -105,11 +118,11 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) -Note that `ec2_instance_modified_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -146,7 +159,7 @@ It's possible that a new user will start to modify EC2 instances when they haven #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index 08e6099f7f..c91ae03d9a 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -29,57 +29,70 @@ This search looks for EC2 instances being created by users who have not created - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 22773e84-bac0-4595-b086-20d3f735b4f1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ec2_instance_started_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It's possible that a user will start to create EC2 instances when they haven't b #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 6fb04aa05e..c20cd71e8f 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -32,17 +32,18 @@ The search looks at the change-analysis data model and detects email files creat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 8d52cf03-ba25-4101-aa78-07994aed4f74 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,39 +51,51 @@ The search looks at the change-analysis data model and detects email files creat | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ The search looks at the change-analysis data model and detects email files creat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `email_files_written_outside_of_the_outlook_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrators and users sometimes prefer backing up their email data by moving #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index d14b0f44c4..b645d108aa 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -32,17 +32,18 @@ This search looks for an increase of data transfers from your email server to yo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556378 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This search looks for an increase of data transfers from your email server to yo | [T1114.002](https://attack.mitre.org/techniques/T1114/002/) | Remote Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * DE.AE +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ This search looks for an increase of data transfers from your email server to yo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `email_servers_sending_high_volume_traffic_to_hosts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **email_servers_sending_high_volume_traffic_to_hosts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index 37ca68b1b5..33ea7afb51 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -32,17 +32,18 @@ This search identifies DNS query failures by counting the number of DNS response - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499e-9719-17243f9826f1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,45 +51,57 @@ This search identifies DNS query failures by counting the number of DNS response | [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.PT * DE.AE * DE.CM +
CIS20 +
+ * CIS 8 * CIS 9 * CIS 12 +
CVE +
+
#### Search @@ -111,7 +124,7 @@ This search identifies DNS query failures by counting the number of DNS response The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `excessive_dns_failures_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_dns_failures_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index 8f1d7c852e..c73e0ff14c 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -30,17 +30,18 @@ This search looks for command-line arguments that use a `/c` parameter to execut - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: a1b6e73f-98d5-470f-99ac-77aacd578473 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,45 +49,57 @@ This search looks for command-line arguments that use a `/c` parameter to execut | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -113,10 +126,10 @@ This search looks for command-line arguments that use a `/c` parameter to execut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `first_time_seen_command_line_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -159,7 +172,7 @@ Legitimate programs can also use command-line arguments to execute. Please verif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index 56b19a889f..2710475c14 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -31,17 +31,18 @@ This search looks for the first and last time a Windows service is seen running - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 823136f2-d755-4b6d-ae04-372b486a5808 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,22 +50,28 @@ This search looks for the first and last time a Windows service is seen running | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS * PR.AC @@ -72,23 +79,29 @@ This search looks for the first and last time a Windows service is seen running +
CIS20 +
+ * CIS 2 * CIS 9 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) -Note that `first_time_seen_running_windows_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **first_time_seen_running_windows_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -147,7 +160,7 @@ A previously unseen service is not necessarily malicious. Verify that the servic #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index 93899e863f..74ca087556 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -29,18 +29,19 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,41 +49,53 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h | [T1222.001](https://attack.mitre.org/techniques/T1222/001/) | Windows File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `hiding_files_and_directories_with_attrib_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Some applications and users may legitimately use attrib.exe to interact with the #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 470b81ed0f..332dbc6015 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -32,17 +32,18 @@ This search looks for an increase of data transfers from your email server to yo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556368 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This search looks for an increase of data transfers from your email server to yo | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * DE.AE +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ This search looks for an increase of data transfers from your email server to yo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `hosts_receiving_high_volume_of_network_traffic_from_email_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **hosts_receiving_high_volume_of_network_traffic_from_email_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ The false-positive rate will vary based on how you set the deviation_threshold a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 6ed35b928c..253df857d9 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -29,18 +29,19 @@ This search looks for PowerShell processes started with parameters used to bypas - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Mauricio Velazco, Splunk - **ID**: 9be56c82-b1cc-4318-87eb-d138afaaca39 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,46 +49,58 @@ This search looks for PowerShell processes started with parameters used to bypas | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -103,11 +116,11 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `malicious_powershell_process_-_execution_policy_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ There may be legitimate reasons to bypass the PowerShell execution policy. The P #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 55b10394e6..326187b09a 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -37,17 +37,18 @@ This search detects Okta login failures due to bad credentials for multiple user - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 19cba45f-cad3-4032-8911-0c09e0444552 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,41 +56,53 @@ This search detects Okta login failures due to bad credentials for multiple user | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,10 +119,10 @@ This search detects Okta login failures due to bad credentials for multiple user #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) -Note that `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ A single public IP address servicing multiple legitmate users may trigger this s #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index b26ca4e425..122cef7fb1 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -37,17 +37,18 @@ Detect Okta user lockout events - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 62b70968-a0a5-4724-8ac4-67871e6f544d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,41 +56,53 @@ Detect Okta user lockout events | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ Detect Okta user lockout events The SPL above uses the following Macros: * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) -Note that `okta_account_lockout_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **okta_account_lockout_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ None. Account lockouts should be followed up on to determine if the actual user #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index 53c13187f9..cc03763381 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -37,17 +37,18 @@ Detect failed Okta SSO events - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 371a6545-2618-4032-ad84-93386b8698c5 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,41 +56,53 @@ Detect failed Okta SSO events | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ Detect failed Okta SSO events #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) -Note that `okta_failed_sso_attempts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ There may be a faulty config preventing legitmate users from accessing apps they #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 17c445966b..0cd59c7473 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -37,17 +37,18 @@ This search detects logins from the same user from different cities in a 24 hour - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,41 +56,53 @@ This search detects logins from the same user from different cities in a 24 hour | [T1078.001](https://attack.mitre.org/techniques/T1078/001/) | Default Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -105,10 +118,10 @@ This search detects logins from the same user from different cities in a 24 hour #### Macros The SPL above uses the following Macros: -* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) -Note that `okta_user_logins_from_multiple_cities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Users in your enviornment may legitmately be travelling and loggin in from diffe #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index 0351b9f649..131764c0e4 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -31,18 +31,19 @@ Microsoft Windows contains accessibility features that can be launched with a ke - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,42 +51,54 @@ Microsoft Windows contains accessibility features that can be launched with a ke | [T1546.008](https://attack.mitre.org/techniques/T1546/008/) | Accessibility Features | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ Microsoft Windows contains accessibility features that can be launched with a ke #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `overwriting_accessibility_binaries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Microsoft may provide updates to these binaries. Verify that these changes do no #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index d8ad471ebb..e62f64d154 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -29,60 +29,73 @@ This search looks for network traffic defined by port and transport layer protoc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: ce5a0962-849f-4720-a678-753fe6674479 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Delivery * Command & Control +
NIST +
+ * DE.AE * PR.AC +
CIS20 +
+ * CIS 9 * CIS 12 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for network traffic defined by port and transport layer protoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `prohibited_network_traffic_allowed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index e0102125e0..4c55abfac6 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -32,17 +32,18 @@ This search looks for network traffic on common ports where a higher layer proto - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 54dc1265-2f74-4b6d-b30d-49eb506a31b3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This search looks for network traffic on common ports where a higher layer proto | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * DE.AE * PR.AC +
CIS20 +
+ * CIS 9 * CIS 12 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This search looks for network traffic on common ports where a higher layer proto #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `protocol_or_port_mismatch_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index bc40f0c153..0f334bd42e 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -32,17 +32,18 @@ This search looks for RDP application network traffic and filters any source/des - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-21 - **Author**: Jose Hernandez, Splunk - **ID**: a98727cc-286b-4ff2-b898-41df64695923 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,46 +51,58 @@ This search looks for RDP application network traffic and filters any source/des | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Reconnaissance * Delivery +
NIST +
+ * DE.AE * PR.AC * PR.IP +
CIS20 +
+ * CIS 12 * CIS 9 * CIS 16 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ This search looks for RDP application network traffic and filters any source/des The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `remote_desktop_network_bruteforce_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_desktop_network_bruteforce_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ RDP gateways may have unusually high amounts of traffic from all other hosts' RD #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index bc09e9bb94..7309b95c4d 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -32,17 +32,18 @@ This search looks for the remote desktop process mstsc.exe running on systems up - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: f5939373-8054-40ad-8c64-cec478a22a4a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,45 +51,57 @@ This search looks for the remote desktop process mstsc.exe running on systems up | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * PR.AC * PR.IP +
CIS20 +
+ * CIS 3 * CIS 9 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This search looks for the remote desktop process mstsc.exe running on systems up #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_desktop_process_running_on_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Remote Desktop may be used legitimately by users on the network. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index 874537f871..063f6913a4 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -31,18 +31,19 @@ This search looks for arguments to sc.exe indicating the creation or modificatio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,21 +51,27 @@ This search looks for arguments to sc.exe indicating the creation or modificatio | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Installation +
NIST +
+ * PR.IP * PR.PT * PR.AC @@ -73,24 +80,30 @@ This search looks for arguments to sc.exe indicating the creation or modificatio +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 8 +
CVE +
+
#### Search @@ -106,10 +119,10 @@ This search looks for arguments to sc.exe indicating the creation or modificatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `sc_exe_manipulating_windows_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index ef9b8f7a65..0adc1b3fc5 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -29,57 +29,70 @@ This search looks for flags passed to schtasks.exe on the command-line that indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `scheduled_tasks_used_in_badrabbit_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ No known false positives #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index 8ece1cff6b..53230ad0af 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -29,37 +29,44 @@ This search looks for long URLs that have several SQL commands visible within th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: e0aad4cf-0790-423b-8328-7564d0d938f9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.DS * ID.RA * PR.PT @@ -68,24 +75,30 @@ This search looks for long URLs that have several SQL commands visible within th +
CIS20 +
+ * CIS 4 * CIS 13 * CIS 18 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search looks for long URLs that have several SQL commands visible within th The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `sql_injection_with_long_urls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sql_injection_with_long_urls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ It's possible that legitimate traffic will have long URLs or long user agent str #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 9e473aefc1..4da164dcf2 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -32,17 +32,18 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b936378 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,41 +51,53 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `smb_traffic_spike_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **smb_traffic_spike_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ A file server may experience high-demand loads that could cause this analytic to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 74379520ef..5ce11663b5 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -32,17 +32,18 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: d25773ba-9ad8-48d1-858e-07ad0bbeb828 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,41 +51,53 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `smb_traffic_spike_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **smb_traffic_spike_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ If you are seeing more results than desired, you may consider reducing the value #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index d90d5cc966..e48b2a88bd 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -27,60 +27,73 @@ This search looks for changes to registry values that control Windows file assoc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: 1b989a0e-0129-4446-a695-f193a5b746fc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1546.001](https://attack.mitre.org/techniques/T1546/001/) | Change Default File Association | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM * PR.PT * PR.IP +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for changes to registry values that control Windows file assoc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_changes_to_file_associations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ There may be other processes in your environment that users may legitimately use #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index 09f7c3b4de..746344acbe 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -27,57 +27,70 @@ This detection looks for emails that are suspicious because of their sender, dom - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [UEBA](https://docs.splunk.com/Documentation/CIM/latest/User/UEBA) - - **Last Updated**: 2020-07-22 - **Author**: Bhavin Patel, Splunk - **ID**: 56e877a6-1455-4479-ad16-0550dc1e33f8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 7 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This detection looks for emails that are suspicious because of their sender, dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_email_-_uba_anomaly_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ This detection model will alert on any sender domain that is seen for the first #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 33334a861d..68ebb6593a 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -32,17 +32,18 @@ This search looks for emails that have attachments with suspicious file extensio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) - - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,44 +51,56 @@ This search looks for emails that have attachments with suspicious file extensio | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * DE.AE * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 12 +
CVE +
+
#### Search @@ -104,11 +117,11 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `suspicious_email_attachment_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index 4bd4c118f3..9c8f73d6e0 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -26,58 +26,71 @@ This search looks for reg.exe being launched from a command prompt not started b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for reg.exe being launched from a command prompt not started b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_reg_exe_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ It's possible for system administrators to write scripts that exhibit this behav #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index e2445802a7..5a1aa00ddb 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -26,57 +26,70 @@ This search detects writes to the 'System Volume Information' folder by somethin - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -91,10 +104,10 @@ This search detects writes to the 'System Volume Information' folder by somethin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_writes_to_system_volume_information_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ It is possible that other utilities or system processes may legitimately write t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index 65d6523f76..9681c6beed 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -26,57 +26,70 @@ This search detects writes to the recycle bin by a process other than explorer.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: b5541828-8ffd-4070-9d95-b3da4de924cb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This search detects writes to the recycle bin by a process other than explorer.e The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `suspicious_writes_to_windows_recycle_bin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_writes_to_windows_recycle_bin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Because the Recycle Bin is a hidden folder in modern versions of Windows, it wou #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index a6661b18f9..8001dd1e4e 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -32,17 +32,18 @@ This search looks for network traffic identified as The Onion Router (TOR), a be - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: ea688274-9c06-4473-b951-e4cb7a5d7a45 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,42 +51,54 @@ This search looks for network traffic identified as The Onion Router (TOR), a be | [T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Web Protocols | Command And Control | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * DE.AE +
CIS20 +
+ * CIS 9 * CIS 12 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for network traffic identified as The Onion Router (TOR), a be #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `tor_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ None at this time #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index d0edda8cae..ffccb288b3 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -27,58 +27,71 @@ This search looks for applications on the endpoint that you have marked as uncom - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 29ccce64-a10c-4389-a45f-337cb29ba1f7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 2 +
CVE +
+
#### Search @@ -95,11 +108,11 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `uncommon_processes_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index 1c709b519f..67c9dc6275 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -29,18 +29,19 @@ Attackers often disable security tools to avoid detection. This search looks for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-22 - **Author**: Bhavin Patel, Splunk - **ID**: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,41 +49,53 @@ Attackers often disable security tools to avoid detection. This search looks for | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ Attackers often disable security tools to avoid detection. This search looks for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unload_sysmon_filter_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ You must be ingesting data that records process activity from your hosts to popu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 1067828ad6..70cb37dd9b 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -31,53 +31,66 @@ This search provides detection of an user attaching itself to a different role t - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 88fc31dd-f331-448c-9856-d3d51dd5d3a1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This search provides detection of an user attaching itself to a different role t The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `aws_detect_attach_to_role_policy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_attach_to_role_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ Attach to policy can create a lot of noise. This search can be adjusted to provi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index 89ff23aac5..f6cf61a2b8 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -31,53 +31,66 @@ This search provides detection of accounts creating permanent keys. Permanent ke - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,7 +107,7 @@ This search provides detection of accounts creating permanent keys. Permanent ke The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `aws_detect_permanent_key_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_permanent_key_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Not all permanent key creations are malicious. If there is a policy of rotating #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index b0d7cab620..a3bd6b5f6b 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -31,53 +31,66 @@ This search provides detection of role creation by IAM users. Role creation is a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 5f04081e-ddee-4353-afe4-504f288de9ad -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search provides detection of role creation by IAM users. Role creation is a The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `aws_detect_role_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_role_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ CreateRole is not very common in common users. This search can be adjusted to pr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index 557f16448d..d0ebbd3224 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -31,53 +31,66 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 8e565314-b6a2-46d8-9f05-1a34a176a662 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_detect_sts_assume_role_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_sts_assume_role_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 33938bea7b..a5eeabea8a 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -29,53 +29,66 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 85d7b35f-b8b5-4b01-916f-29b81e7a0551 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1550](https://attack.mitre.org/techniques/T1550/) | Use Alternate Authentication Material | Defense Evasion, Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t The SPL above uses the following Macros: * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml) -Note that `aws_detect_sts_get_session_token_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_sts_get_session_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Sts:GetSessionToken can be very noisy as in certain environments numerous calls #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index fa0b40947c..139a7c944f 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -29,62 +29,75 @@ This search detects SIGRed via Splunk Stream. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-07-28 - **Author**: Shannon Davis, Splunk - **ID**: babd8d10-d073-11ea-87d0-0242ac130003 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 | +
#### Search @@ -107,7 +120,7 @@ The SPL above uses the following Macros: * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) * [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) -Note that `detect_windows_dns_sigred_via_splunk_stream_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 7db7924633..4034326e39 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -30,62 +30,75 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2020-07-28 - **Author**: Shannon Davis, Splunk - **ID**: c5c622e4-d073-11ea-87d0-0242ac130003 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2020-1350](https://nvd.nist.gov/vuln/detail/CVE-2020-1350) | A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'. | 10.0 | +
#### Search @@ -107,7 +120,7 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_windows_dns_sigred_via_zeek_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_windows_dns_sigred_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 9bf2ed2c4c..64b17deb2a 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -35,18 +35,19 @@ This search looks for cloud instances being modified by users who have not previ - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-07-29 - **Author**: Rico Valdez, Splunk - **ID**: 7fb15084-b14e-405a-bd61-a6de15a40722 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,41 +55,53 @@ This search looks for cloud instances being modified by users who have not previ | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -109,10 +122,10 @@ This search looks for cloud instances being modified by users who have not previ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_instance_modified_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -152,7 +165,7 @@ It's possible that a new user will start to modify EC2 instances when they haven #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 0412c70cfa..63c1f1e698 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -29,62 +29,75 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-08-02 - **Author**: Shannon Davis, Splunk - **ID**: 810e4dbc-d46e-11ea-87d0-0242ac130003 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 11 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2020-5902](https://nvd.nist.gov/vuln/detail/CVE-2020-5902) | In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. | 10.0 | +
#### Search @@ -100,7 +113,7 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff The SPL above uses the following Macros: * [f5_bigip_rogue](https://github.com/splunk/security_content/blob/develop/macros/f5_bigip_rogue.yml) -Note that `detect_f5_tmui_rce_cve-2020-5902_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_f5_tmui_rce_cve-2020-5902_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index d146b4ceb4..f1946af888 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -28,59 +28,72 @@ This search looks for GCP PubSub events where a user has created an open/public - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-08-05 - **Author**: Shannon Davis, Splunk - **ID**: f6ea3466-d6bb-11ea-87d0-0242ac130003 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search looks for GCP PubSub events where a user has created an open/public The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `detect_new_open_gcp_storage_buckets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_open_gcp_storage_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ While this search has no known false positives, it is possible that a GCP admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index 7fbb901e4e..065db4f9c3 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -28,60 +28,73 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-08-10 - **Author**: Shannon Davis, Splunk - **ID**: ccc3246a-daa1-11ea-87d0-0242ac130022 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 * CIS 14 +
CVE +
+
#### Search @@ -112,7 +125,7 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `detect_gcp_storage_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_gcp_storage_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -152,7 +165,7 @@ GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow i #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index e48dd7cf9a..9bad7b85c1 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -39,17 +39,18 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-08-11 - **Author**: Mikael Bjerkeland, Splunk - **ID**: b44bebd6-bd39-467b-9321-73971bcd7aac -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -61,45 +62,57 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access | +
Kill Chain Phase +
+ * Reconnaissance * Delivery * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -118,7 +131,7 @@ The SPL above uses the following Macros: * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_arp_poisoning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,7 +167,7 @@ This search might be prone to high false positives if DHCP Snooping or ARP inspe #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 26359790c5..f57584d02f 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -35,17 +35,18 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-08-11 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 6e1ada88-7a0d-4ac1-92c6-03d354686079 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,45 +56,57 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne | [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access | +
Kill Chain Phase +
+ * Reconnaissance * Delivery * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -111,7 +124,7 @@ The SPL above uses the following Macros: * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rogue_dhcp_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ This search might be prone to high false positives if DHCP Snooping has been inc #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index 36be1c0bbf..c62e53acfe 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -29,58 +29,71 @@ This search looks for cloud provisioning activities from previously unseen IP ad - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-08-16 - **Author**: Rico Valdez, Splunk - **ID**: f86a8ec9-b042-45eb-92f4-e9ed1d781078 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -104,7 +117,7 @@ The SPL above uses the following Macros: * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_provisioning_activity_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -145,7 +158,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index 77c0999154..50ec849700 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -29,58 +29,71 @@ This search looks for cloud provisioning activities from previously unseen regio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-08-16 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: 5aba1860-9617-4af9-b19d-aecac16fe4f2 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ The SPL above uses the following Macros: * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_provisioning_activity_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_provisioning_activity_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -147,7 +160,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 7f4e805abf..725d122879 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -38,17 +38,18 @@ This search finds for the number successfully destroyed cloud instances for ever - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) - - **Last Updated**: 2020-08-21 - **Author**: David Dorsey, Splunk - **ID**: ef629fc9-1583-4590-b62a-f2247fbf7bbf -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -56,42 +57,54 @@ This search finds for the number successfully destroyed cloud instances for ever | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -118,7 +131,7 @@ This search finds for the number successfully destroyed cloud instances for ever #### Macros The SPL above uses the following Macros: -Note that `abnormally_high_number_of_cloud_instances_destroyed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_number_of_cloud_instances_destroyed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Many service accounts configured within a cloud infrastructure are known to exhi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index bacc72d2bb..87429d2be7 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -38,17 +38,18 @@ This search finds for the number successfully created cloud instances for every - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) - - **Last Updated**: 2020-08-21 - **Author**: David Dorsey, Splunk - **ID**: f2361e9f-3928-496c-a556-120cd4223a65 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -56,42 +57,54 @@ This search finds for the number successfully created cloud instances for every | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -118,7 +131,7 @@ This search finds for the number successfully created cloud instances for every #### Macros The SPL above uses the following Macros: -Note that `abnormally_high_number_of_cloud_instances_launched_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_number_of_cloud_instances_launched_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,7 +166,7 @@ Many service accounts configured within an AWS infrastructure are known to exhib #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md index d8f4efd726..d58665dbcd 100644 --- a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md +++ b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md @@ -29,53 +29,66 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-09-01 - **Author**: Rod Soto, Splunk - **ID**: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,7 +103,7 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `gcp_detect_oauth_token_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_detect_oauth_token_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ GCP Oauth token abuse detection will only work if there are access policies in p #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index edac31a512..05ae4bc9ff 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -26,59 +26,72 @@ This search looks at cloud-infrastructure events where an instance is created in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-02 - **Author**: David Dorsey, Splunk - **ID**: fa4089e2-50e3-40f7-8469-d2cc1564ca59 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 12 +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search looks at cloud-infrastructure events where an instance is created in The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_compute_instance_created_in_previously_unused_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_compute_instance_created_in_previously_unused_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -139,7 +152,7 @@ It's possible that a user has unknowingly started an instance in a new region. P #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index ae782d4738..e4fe7f07d7 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -29,58 +29,71 @@ This search looks for new commands from each user role. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-04 - **Author**: David Dorsey, Splunk - **ID**: 2181ad1f-1e73-4d0c-9780-e8880482a08f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -104,7 +117,7 @@ This search looks for new commands from each user role. The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_api_calls_from_previously_unseen_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_api_calls_from_previously_unseen_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -143,7 +156,7 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 0bdc68e10f..0a35691f4e 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -35,18 +35,19 @@ This search will detect a spike in the number of API calls made to your cloud in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-07 - **Author**: David Dorsey, Splunk - **ID**: 0840ddf1-8c89-46ff-b730-c8d6722478c0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,43 +55,55 @@ This search will detect a spike in the number of API calls made to your cloud in | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -118,7 +131,7 @@ This search will detect a spike in the number of API calls made to your cloud in #### Macros The SPL above uses the following Macros: -Note that `abnormally_high_number_of_cloud_infrastructure_api_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_number_of_cloud_infrastructure_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index 3daab21ed3..62e821ae4d 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -35,18 +35,19 @@ This search will detect a spike in the number of API calls made to your cloud in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-07 - **Author**: David Dorsey, Splunk - **ID**: d4dfb7f3-7a37-498a-b5df-f19334e871af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,43 +55,55 @@ This search will detect a spike in the number of API calls made to your cloud in | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.CM * PR.AC +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -118,7 +131,7 @@ This search will detect a spike in the number of API calls made to your cloud in #### Macros The SPL above uses the following Macros: -Note that `abnormally_high_number_of_cloud_security_group_api_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **abnormally_high_number_of_cloud_security_group_api_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ You must be ingesting your cloud infrastructure logs. You also must run the base #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 1242065e6d..8e6d952edd 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -23,53 +23,66 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-09-08 - **Author**: Peter Gael, Splunk - **ID**: 021abc51-1862-41dd-ad43-43c739c0a983 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 11 +
CVE +
+
#### Search @@ -88,7 +101,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_network_access_control_list_deleted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ It's possible that a user has legitimately deleted a network ACL. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index 0364438e33..ff6f217d9e 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -23,53 +23,66 @@ Find EC2 instances being created with previously unseen instance types. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-12 - **Author**: David Dorsey, Splunk - **ID**: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -94,7 +107,7 @@ Find EC2 instances being created with previously unseen instance types. The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_compute_instance_created_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -132,7 +145,7 @@ It is possible that an admin will create a new system using a new instance type #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index f6e8e46d3d..bf1121c205 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -29,62 +29,75 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-09-15 - **Author**: Shannon Davis, Splunk - **ID**: bf7a06ec-f703-11ea-adc1-0242ac120002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 11 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 | +
#### Search @@ -101,7 +114,7 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul The SPL above uses the following Macros: * [zeek_rpc](https://github.com/splunk/security_content/blob/develop/macros/zeek_rpc.yml) -Note that `detect_zerologon_via_zeek_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_zerologon_via_zeek_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index a022b9fcfa..acfcc29d2a 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -29,18 +29,19 @@ This search looks for the creation or deletion of hidden shares using net.exe. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-09-16 - **Author**: Bhavin Patel, Splunk - **ID**: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for the creation or deletion of hidden shares using net.exe. | [T1070.005](https://attack.mitre.org/techniques/T1070/005/) | Network Share Connection Removal | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `create_or_delete_windows_shares_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrators often leverage net.exe to create or delete network shares. You sh #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index e4e719947f..27746874e4 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -29,63 +29,76 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-09-18 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 1400624a-d42d-484d-8843-e6753e6e3645 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1210](https://attack.mitre.org/techniques/T1210/) | Exploitation of Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472) | An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'. | 9.3 | +
#### Search @@ -100,7 +113,7 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `detect_computer_changed_with_anonymous_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_computer_changed_with_anonymous_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ None thus far found #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index c0b164691a..2661650d56 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -27,58 +27,71 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_aws_console_login_by_user_from_new_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_aws_console_login_by_user_from_new_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -144,7 +157,7 @@ When a legitimate new user logins for the first time, this activity will be dete #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index c0e87f1510..7fca14f159 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -27,58 +27,71 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 67bd3def-c41c-4bf6-837b-ae196b4257c6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_aws_console_login_by_user_from_new_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_aws_console_login_by_user_from_new_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -144,7 +157,7 @@ When a legitimate new user logins for the first time, this activity will be dete #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index ca1888bcec..3c23e9ebd4 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -27,58 +27,71 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) - - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_aws_console_login_by_user_from_new_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_aws_console_login_by_user_from_new_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -144,7 +157,7 @@ When a legitimate new user logins for the first time, this activity will be dete #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 40372c2378..e95210d731 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -31,53 +31,66 @@ This search provides detection of GCPloit exploitation framework. This framework - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-08 - **Author**: Rod Soto, Splunk - **ID**: a1c5a85e-a162-410c-a5d9-99ff639e5a52 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search provides detection of GCPloit exploitation framework. This framework The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `gcp_detect_gcploit_framework_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_detect_gcploit_framework_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Payload.request.function.timeout value can possibly be match with other function #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index dfb0b9f04a..93ae6e9aa2 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -29,58 +29,71 @@ This search looks for cloud provisioning activities from previously unseen citie - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-10-09 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: e7ecc5e0-88df-48b9-91af-51104c68f02f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ The SPL above uses the following Macros: * [previously_unseen_cloud_provisioning_activity_window](https://github.com/splunk/security_content/blob/develop/macros/previously_unseen_cloud_provisioning_activity_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_provisioning_activity_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_provisioning_activity_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -147,7 +160,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index 732f4d2e1e..6021c70aa9 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -29,58 +29,71 @@ This search looks for cloud provisioning activities from previously unseen count - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-10-09 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: 94994255-3acf-4213-9b3f-0494df03bb31 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ This search looks for cloud provisioning activities from previously unseen count The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_provisioning_activity_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_provisioning_activity_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -146,7 +159,7 @@ This is a strictly behavioral search, so we define "false positive" slightly dif #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md index 2e570612cc..fb787ff0ca 100644 --- a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md +++ b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md @@ -29,53 +29,66 @@ This search provides detection of accounts with high risk roles by projects. Com - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-09 - **Author**: Rod Soto, Splunk - **ID**: 27af8c15-38b0-4408-b339-920170724adb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,7 +103,7 @@ This search provides detection of accounts with high risk roles by projects. Com The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `gcp_detect_accounts_with_high_risk_roles_by_project_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_detect_accounts_with_high_risk_roles_by_project_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Accounts with high risk roles should be reduced to the minimum number needed, ho #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md index cdc24a2ba8..07fc7148c8 100644 --- a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md +++ b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md @@ -29,53 +29,66 @@ This search provides detection of high risk permissions by resource and accounts - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-09 - **Author**: Rod Soto, Splunk - **ID**: 2e70ef35-2187-431f-aedc-4503dc9b06ba -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,7 +103,7 @@ This search provides detection of high risk permissions by resource and accounts The SPL above uses the following Macros: * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) -Note that `gcp_detect_high_risk_permissions_by_resource_and_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gcp_detect_high_risk_permissions_by_resource_and_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ High risk permissions are part of any GCP environment, however it is important t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 22eb36b0ca..369753c2c9 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -31,17 +31,18 @@ This search looks for specific authentication events from the Windows Security E - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-15 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: f5939373-8054-40ad-8c64-cec478a22a4b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,21 +50,27 @@ This search looks for specific authentication events from the Windows Security E | [T1550.002](https://attack.mitre.org/techniques/T1550/002/) | Pass the Hash | Defense Evasion, Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -71,24 +78,30 @@ This search looks for specific authentication events from the Windows Security E +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_activity_related_to_pass_the_hash_attacks_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Legitimate logon activity by authorized NTLM systems may be detected by this sea #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 043f248434..c66ed418e7 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -28,59 +28,72 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-21 - **Author**: Shannon Davis, Splunk - **ID**: 82d06410-134c-11eb-adc1-0242ac120002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1041](https://attack.mitre.org/techniques/T1041/) | Exfiltration Over C2 Channel | Exfiltration | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * DE.CM * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. The SPL above uses the following Macros: * [zeek_ssl](https://github.com/splunk/security_content/blob/develop/macros/zeek_ssl.yml) -Note that `detect_snicat_sni_exfiltration_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_snicat_sni_exfiltration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index aaafb8cc2e..f75b40d407 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -39,17 +39,18 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: c3be767e-7959-44c5-8976-0e9c12a91ad2 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -61,45 +62,57 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access | +
Kill Chain Phase +
+ * Reconnaissance * Delivery * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -120,7 +133,7 @@ The SPL above uses the following Macros: * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_ipv6_network_infrastructure_threats_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -169,7 +182,7 @@ None currently known #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 95f475d600..71e5f21e2a 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -39,17 +39,18 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 2de3d5b8-a4fa-45c5-8540-6d071c194d24 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -61,46 +62,58 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access | +
Kill Chain Phase +
+ * Reconnaissance * Delivery * Exploitation * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -119,7 +132,7 @@ The SPL above uses the following Macros: * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_port_security_violation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -158,7 +171,7 @@ This search might be prone to high false positives if you have malfunctioning de #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 13230079b0..37506021e4 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -34,17 +34,18 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: cc590c66-f65f-48f2-986a-4797244762f8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin | [T1542](https://attack.mitre.org/techniques/T1542/) | Pre-OS Boot | Defense Evasion, Persistence | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_software_download_to_network_device_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ This search will also report any legitimate attempts of software downloads to ne #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 583af0f09f..f8405f4c7e 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -37,17 +37,18 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 42b3b753-5925-49c5-9742-36fa40a73990 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -59,44 +60,56 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio | [T1020.001](https://attack.mitre.org/techniques/T1020/001/) | Traffic Duplication | Exfiltration | +
Kill Chain Phase +
+ * Delivery * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 1 * CIS 11 +
CVE +
+
#### Search @@ -114,7 +127,7 @@ The SPL above uses the following Macros: * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_traffic_mirroring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ This search will return false positives for any legitimate traffic captures by n #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index 555162f014..9523f43cb4 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -26,58 +26,71 @@ The search looks for files that contain the key word *Ryuk* under any folder in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ The search looks for files that contain the key word *Ryuk* under any folder in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ryuk_test_files_detected_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ If there are files with this keywoord as file names it might trigger false possi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index dbcc2361a0..ffa3d2b441 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -26,58 +26,71 @@ The search looks for the Console Window Host process (connhost.exe) executed usi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: c114aaca-68ee-41c2-ad8c-32bf21db8769 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ The search looks for the Console Window Host process (connhost.exe) executed usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_connhost_exe_started_forcefully_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ This process should not be ran forcefully, we have not see any false positives f #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 3df7d5a157..36c61ed7ff 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -26,58 +26,71 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 69c12d59-d951-431e-ab77-ec426b8d65e6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_security_account_manager_stopped_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ SAM is a critical windows service, stopping it would cause major issues on an en #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 1d5cdb72b0..f02fcac7ba 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -27,58 +27,71 @@ The search looks for file modifications with extensions commonly used by Ransomw - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -96,11 +109,11 @@ The search looks for file modifications with extensions commonly used by Ransomw #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `common_ransomware_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It is possible for a legitimate file with these extensions to be created. If thi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index 3b03d6be5c..44adeda210 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -27,58 +27,71 @@ The search looks for files created with names matching those typically used in r - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd71 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -95,11 +108,11 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `common_ransomware_notes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ It's possible that a legitimate file could be created with the same name used by #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index 5f7b0024bb..fa8862e06e 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -26,61 +26,74 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: b89919ed-ee5f-492c-b139-95dbb162039e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 8 * CIS 10 +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `deleting_shadow_copies_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ vssadmin.exe and wmic.exe are standard applications shipped with modern versions #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index 9f2a028e81..e75d7d4931 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -36,17 +36,18 @@ This search identifies endpoints that have caused a relatively high number of ac - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) - - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: c026e3dd-7e18-4abb-8f41-929e836efe74 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,41 +55,53 @@ This search identifies endpoints that have caused a relatively high number of ac | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -106,10 +119,10 @@ This search identifies endpoints that have caused a relatively high number of ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_excessive_account_lockouts_from_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ It's possible that a widely used system, such as a kiosk, could cause a large nu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index 6581eea755..502f692553 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -26,61 +26,74 @@ This search looks for fast execution of processes used for system network config - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-10 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery | +
Kill Chain Phase +
+ * Installation * Command & Control * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 2 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_processes_used_for_system_network_configuration_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ It is uncommon for normal users to execute a series of commands used for network #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 514e697a6e..76156322eb 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -30,17 +30,18 @@ This search looks for executions of cmd.exe spawned by a process that is often a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-11-10 - **Author**: Bhavin Patel, Splunk - **ID**: dcfd6b40-42f9-469d-a433-2e53f7486664 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for executions of cmd.exe spawned by a process that is often a | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,12 +113,12 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_prohibited_applications_spawning_cmd_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ There are circumstances where an application may legitimately execute and intera #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index 1b68b1935c..784efe8c89 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -31,17 +31,18 @@ The search looks for modifications to registry keys that control the enforcement - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-11-18 - **Author**: David Dorsey, Patrick Bareiss, Splunk - **ID**: bbc644bc-37df-4e1a-9c88-ec9a53e2038c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,42 +50,54 @@ The search looks for modifications to registry keys that control the enforcement | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The search looks for modifications to registry keys that control the enforcement The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_remote_user_account_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_remote_user_account_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ This registry key may be modified via administrators to implement a change in sy #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index 2c1e0f362f..7c6c0f01f0 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -29,18 +29,19 @@ This search looks for processes launched from files that have double extensions - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-18 - **Author**: Rico Valdez, Splunk - **ID**: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,44 +49,56 @@ This search looks for processes launched from files that have double extensions | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM * PR.PT * PR.IP +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search looks for processes launched from files that have double extensions #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `execution_of_file_with_multiple_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index fb22d1a060..87ee25c640 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -27,60 +27,73 @@ This search looks for processes launched from files with at least five spaces in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-11-19 - **Author**: Rico Valdez, Splunk - **ID**: ab0353e6-a956-420b-b724-a8b4846d5d5a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM * PR.PT * PR.IP +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This search looks for processes launched from files with at least five spaces in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `execution_of_file_with_spaces_before_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index 6acc864188..18a23c62e3 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -27,58 +27,71 @@ This search looks for processes launching netsh.exe to execute various commands - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2020-11-23 - **Author**: Bhavin Patel, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162041e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1562.004](https://attack.mitre.org/techniques/T1562/004/) | Disable or Modify System Firewall | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search looks for processes launching netsh.exe to execute various commands #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `processes_created_by_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ It is unusual for netsh.exe to have any child processes in most environments. It #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 6476593e2f..6bd8aaf93b 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -31,18 +31,19 @@ This search detects the process execution and arguments required to silently cre - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-23 - **Author**: David Dorsey, Splunk - **ID**: 404620de-46d8-48b6-90cc-8a8d7b0876a3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,41 +51,53 @@ This search detects the process execution and arguments required to silently cre | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search detects the process execution and arguments required to silently cre #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `shim_database_installation_with_suspicious_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ None identified #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index f8476be65c..bc69dca97c 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -33,18 +33,19 @@ The search looks for reg.exe modifying registry keys that define Windows service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-26 - **Author**: Rico Valdez, Splunk - **ID**: 8470d755-0c13-45b3-bd63-387a373c10cf -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,21 +53,27 @@ The search looks for reg.exe modifying registry keys that define Windows service | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Installation +
NIST +
+ * PR.IP * PR.PT * PR.AC @@ -75,24 +82,30 @@ The search looks for reg.exe modifying registry keys that define Windows service +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 8 +
CVE +
+
#### Search @@ -108,10 +121,10 @@ The search looks for reg.exe modifying registry keys that define Windows service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `reg_exe_manipulating_windows_services_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ It is unusual for a service to be created or modified by directly manipulating t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index ebe21c9e2d..28e8dc1375 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -33,18 +33,19 @@ This search looks for flags passed to schtasks.exe on the command-line that indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-07 - **Author**: Bhavin Patel, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,41 +53,53 @@ This search looks for flags passed to schtasks.exe on the command-line that indi | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This search looks for flags passed to schtasks.exe on the command-line that indi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schtasks_used_for_forcing_a_reboot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Administrators may create jobs on systems forcing reboots to perform updates, ma #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index 6523e0dc60..ad652b1afd 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -31,17 +31,18 @@ This search looks for shim database files being written to default directories. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ This search looks for shim database files being written to default directories. | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search looks for shim database files being written to default directories. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `shim_database_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Because legitimate shim files are created and used all the time, this event, in #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index 7fb462bee7..b5ea8e9863 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -29,18 +29,19 @@ This search looks for process names that consist only of a single letter. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for process names that consist only of a single letter. | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 2 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This search looks for process names that consist only of a single letter. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `single_letter_process_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Single-letter executables are not always malicious. Investigate this activity wi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 1d4d831c04..c66624c3ed 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -31,18 +31,19 @@ During triage, review the parallel processes - what process moved the native Win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: a34aae96-ccf8-4aef-952c-3ea21444444d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,42 +51,54 @@ During triage, review the parallel processes - what process moved the native Win | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -103,10 +116,10 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `system_processes_run_from_unexpected_locations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ This detection may require tuning based on third party applications utilizing na #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 9fb0a48eed..fb85f45b4f 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -25,53 +25,66 @@ Command lines that are extremely long may be indicative of malicious activity on - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: c77162d3-f93c-45cc-80c8-22f6a4264e7f -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -92,10 +105,10 @@ Command lines that are extremely long may be indicative of malicious activity on #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unusually_long_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Some legitimate applications start with long command lines. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index aa45cb9c6d..7d6bea5162 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -36,17 +36,18 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-08 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,21 +55,27 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -76,23 +83,29 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -108,7 +121,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons The SPL above uses the following Macros: * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) -Note that `wmi_permanent_event_subscription_-_sysmon_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmi_permanent_event_subscription_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ Although unlikely, administrators may use event subscriptions for legitimate pur #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 8841cc35f4..0aa0abaa98 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -28,58 +28,71 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-14 - **Author**: Patrick Bareiss, Splunk - **ID**: 701a8740-e8db-40df-9190-5516d3819787 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1203](https://attack.mitre.org/techniques/T1203/) | Exploitation for Client Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `sunburst_correlation_dll_and_network_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index bede7c7bc7..fc881e7ca1 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -29,17 +29,18 @@ This search detects the assignment of rights to accesss content from another mai - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-15 - **Author**: Patrick Bareiss, Splunk - **ID**: b25d2973-303e-47c8-bacd-52b61604c6a7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ This search detects the assignment of rights to accesss content from another mai | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search detects the assignment of rights to accesss content from another mai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_suspicious_rights_delegation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_suspicious_rights_delegation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Service Accounts #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 8baadece00..6695f32192 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -31,17 +31,18 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-16 - **Author**: Bhavin Patel, Splunk - **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02222 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,42 +50,54 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -100,7 +113,7 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir The SPL above uses the following Macros: * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) -Note that `high_number_of_login_failures_from_a_single_source_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **high_number_of_login_failures_from_a_single_source_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index ef11c64d3c..a7bc06c011 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -26,53 +26,66 @@ This search detects when a user has performed an Ediscovery search or exported a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-16 - **Author**: Rod Soto, Splunk - **ID**: 5f694cc4-a678-4a60-9410-bffca1b647dc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ This search detects when a user has performed an Ediscovery search or exported a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_pst_export_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_pst_export_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ PST export can be done for legitimate purposes but due to the sensitive nature o #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 11b4b70be0..b3a5e29bb6 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -29,17 +29,18 @@ This search detects when an admin configured a forwarding rule for multiple mail - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-16 - **Author**: Patrick Bareiss, Splunk - **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02c28 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ This search detects when an admin configured a forwarding rule for multiple mail | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search detects when an admin configured a forwarding rule for multiple mail #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_suspicious_admin_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_suspicious_admin_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index 94e5a2d2a7..86a3931e47 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -29,17 +29,18 @@ This search detects when multiple user configured a forwarding rule to the same - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2020-12-16 - **Author**: Patrick Bareiss, Splunk - **ID**: f8dfe015-dbb3-4569-ba75-b13787e06aa4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ This search detects when multiple user configured a forwarding rule to the same | [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This search detects when multiple user configured a forwarding rule to the same #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_suspicious_user_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_suspicious_user_email_forwarding_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index 53034cb2a1..447549f4e1 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -26,58 +26,71 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-21 - **Author**: Michael Haag, Splunk - **ID**: 809b31d2-5462-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `bcdedit_failure_recovery_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Administrators may modify the boot configuration. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 98d549af38..3b00b01d2b 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -29,37 +29,44 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2021-01-06 - **Author**: John Stoner, Splunk - **ID**: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.DS * ID.RA * PR.PT @@ -68,24 +75,30 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. +
CIS20 +
+ * CIS 4 * CIS 13 * CIS 18 +
CVE +
+
#### Search @@ -100,7 +113,7 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `supernova_webshell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **supernova_webshell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ There might be false positives associted with this detection since items like ar #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index 1fc3491e44..32c4fc9331 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -26,53 +26,66 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-11 - **Author**: Rod Soto, Patrick Bareiss Splunk - **ID**: c79c164f-4b21-4847-98f9-cf6a9f49179e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index de234d7adc..aa8a2bf23f 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -26,53 +26,66 @@ This search provides detection of users with KMS keys performing encryption spec - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-11 - **Author**: Rod Soto, Patrick Bareiss Splunk - **ID**: 884a5f59-eec7-4f4a-948b-dbde18225fdc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,7 +104,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_detect_users_with_kms_keys_performing_encryption_s3_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ bucket with S3 encryption #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 9297d4598f..c3854cdbd8 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -29,17 +29,18 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-11 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd75 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 11 +
CVE +
+
#### Search @@ -104,7 +117,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_network_access_control_list_created_with_all_open_ports_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ It's possible that an admin has created this ACL with all ports open for some le #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index f02f3be467..6a01a575a2 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -29,17 +29,18 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-12 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6fd75 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 11 +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_network_access_control_list_deleted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ It's possible that a user has legitimately deleted a network ACL. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 3c4a8d524c..4f82c754df 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -26,59 +26,72 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 9bbc62e8-55d8-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_microsoft_workflow_compiler_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Although unlikely, limited instances have been identified coming from native Mic #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md index a376d8aaa7..06586b0d97 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md @@ -35,18 +35,19 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 4006adac-5937-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,42 +59,54 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -109,11 +122,11 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_msbuild_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -161,7 +174,7 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index 603ef7cf00..25c80612a1 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -29,18 +29,19 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: a115fba6-5514-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_msbuild_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index ba42ac248c..b9fcb706d2 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -29,18 +29,19 @@ The following analytic identifies child processes spawning from "mshta.exe". Th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 60023bb6-5500-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies child processes spawning from "mshta.exe". Th | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies child processes spawning from "mshta.exe". Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_mshta_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index e80352fab9..a10e6b0b72 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -27,38 +27,45 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2021-01-14 - **Author**: Bhavin Patel, Splunk - **ID**: a1e761ac-1344-4dbd-88b2-3f34c912d359 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1189](https://attack.mitre.org/techniques/T1189/) | Drive-by Compromise | Initial Access | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.DS * PR.PT * DE.AE @@ -66,24 +73,30 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p +
CIS20 +
+ * CIS 8 * CIS 12 * CIS 13 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_hosts_connecting_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index c96f5e3da4..7937cba86e 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -29,18 +29,19 @@ This search looks for PowerShell processes launched with arguments that have cha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-19 - **Author**: David Dorsey, Splunk - **ID**: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,46 +49,58 @@ This search looks for PowerShell processes launched with arguments that have cha | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -105,11 +118,11 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `malicious_powershell_process_with_obfuscation_techniques_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ These characters might be legitimately on the command-line, but it is not common #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md index de660273d6..572f984ae5 100644 --- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -27,62 +27,75 @@ This search looks for PowerShell processes started with a base64 encoded command - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-01-19 - **Author**: David Dorsey, Splunk - **ID**: 2cdb91d2-542c-497f-b252-be495e71f38c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search looks for PowerShell processes started with a base64 encoded command #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_powershell_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Legitimate process can have this combination of command-line options, but it's n #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index bdd93f96ab..e62daac2cd 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -29,18 +29,19 @@ The following analytic identifies "rundll32.exe" execution with inline protocol - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-20 - **Author**: Michael Haag, Splunk - **ID**: 91c79f14-5b41-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies "rundll32.exe" execution with inline protocol | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rundll32_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 8c7b5bf8c7..5540330e5b 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -29,18 +29,19 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-20 - **Author**: Michael Haag, Splunk - **ID**: 4d33a488-5b5f-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that `suspicious_mshta_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index fdf29d70ab..cc81f64a4c 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -26,58 +26,71 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-22 - **Author**: Michael Haag, Splunk - **ID**: cd5aed7e-5cea-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wbadmin_delete_system_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators may modify the boot configuration. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md index 2a7b37802c..946445f63d 100644 --- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md +++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md @@ -26,59 +26,72 @@ This search looks for the execution of `nltest.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-25 - **Author**: Michael Haag, Splunk - **ID**: c3e05466-5f22-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search looks for the execution of `nltest.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `nltest_domain_trust_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrators may use nltest for troubleshooting purposes, otherwise, rarely us #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 8b373b9c25..c659f13c37 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -29,53 +29,66 @@ This search provides specific SAML access from specific Service Provider, user a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: bbe23980-6019-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_saml_access_by_provider_user_and_principal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very diff #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index 05ed48afe2..a8e75ff12f 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -29,53 +29,66 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 2f0604c6-6030-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_saml_update_identity_provider_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Updating a SAML provider or creating a new one may not necessarily be malicious #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index 35610f545a..36145ee1f4 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -23,49 +23,62 @@ This search looks for arguments to certutil.exe indicating the manipulation or e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 337a46be-600f-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Installation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -80,10 +93,10 @@ This search looks for arguments to certutil.exe indicating the manipulation or e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `certutil_exe_certificate_extraction_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ Unless there are specific use cases, manipulating or exporting certificates usin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index c44365b98e..ae1faef83a 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -23,52 +23,65 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2 - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.DP +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -89,7 +102,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2 The SPL above uses the following Macros: * [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml) -Note that `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ None #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 5831d30add..d1721aae97 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -25,53 +25,66 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.DP * DE.AE +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS The SPL above uses the following Macros: * [aws_securityhub_finding](https://github.com/splunk/security_content/blob/develop/macros/aws_securityhub_finding.yml) -Note that `detect_spike_in_aws_security_hub_alerts_for_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_spike_in_aws_security_hub_alerts_for_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ None #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index fd323f140e..ecf695a712 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -29,17 +29,18 @@ This search detects the creation of a new Federation setting by alerting about a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: b2c81cc6-6040-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search detects the creation of a new Federation setting by alerting about a | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_add_app_role_assignment_grant_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_add_app_role_assignment_grant_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ The creation of a new Federation is not necessarily malicious, however this even #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index 0917f483da..a225ee8e1e 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -28,53 +28,66 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 8158ccc4-6038-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_excessive_sso_logon_errors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_excessive_sso_logon_errors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Logon errors may not be malicious in nature however it may indicate attempts to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index 27c68803dd..8dd8f7ba2b 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -29,17 +29,18 @@ This search detects the addition of a new Federated domain. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: e155876a-6048-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search detects the addition of a new Federated domain. | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ This search detects the addition of a new Federated domain. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_new_federated_domain_added_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_new_federated_domain_added_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ The creation of a new Federated domain is not necessarily malicious, however the #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md index 9bc36c1f72..87864a075f 100644 --- a/docs/_posts/2021-01-26-revil_registry_entry.md +++ b/docs/_posts/2021-01-26-revil_registry_entry.md @@ -26,54 +26,67 @@ This analytic identifies suspicious modification in registry entry to keep some - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: e3d3f57a-c381-11eb-9e35-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This analytic identifies suspicious modification in registry entry to keep some The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `revil_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **revil_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 6a57d5163f..60717f1851 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -29,63 +29,76 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-27 - **Author**: Shannon Davis, Splunk - **ID**: 93fbec4e-0375-440c-8db3-4508eca470c4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | +
#### Search @@ -100,7 +113,7 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml) -Note that `detect_baron_samedit_cve-2021-3156_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_baron_samedit_cve-2021-3156_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index 9affaf177c..66b6df2011 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -29,63 +29,76 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-28 - **Author**: Shannon Davis, Splunk - **ID**: 1de31d5d-8fa6-4ee0-af89-17069134118a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | +
#### Search @@ -100,7 +113,7 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml) -Note that `detect_baron_samedit_cve-2021-3156_via_osquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_baron_samedit_cve-2021-3156_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 8a2ae6792a..97a85c9898 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -30,18 +30,19 @@ Upon investigating, look for network connections to remote destinations (interna - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Splunk - **ID**: 070e9b80-6252-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,42 +50,54 @@ Upon investigating, look for network connections to remote destinations (interna | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ Upon investigating, look for network connections to remote destinations (interna #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `detect_regsvr32_application_control_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Limited false positives related to third party software registering .DLL's. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index 536711d51d..c6f240a0d1 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -31,18 +31,19 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Patrick Bareiss, Splunk - **ID**: da63bc76-61ae-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,42 +51,54 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ntdsutil_export_ntds_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index f426f8b2e3..c4c4425d81 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -29,18 +29,19 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Splunk - **ID**: 62732736-6250-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `suspicious_regsvr32_register_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Limited false positives with the query restricted to specified paths. Add more w #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index f56ffdaf84..758d09be03 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -29,63 +29,76 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-01-29 - **Author**: Shannon Davis, Splunk - **ID**: 10f2bae0-bbe6-4984-808c-37dc1c67980d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-3156](https://nvd.nist.gov/vuln/detail/CVE-2021-3156) | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character. | 7.2 | +
#### Search @@ -102,7 +115,7 @@ This search detects the heap-based buffer overflow of sudoedit The SPL above uses the following Macros: * [linux_hosts](https://github.com/splunk/security_content/blob/develop/macros/linux_hosts.yml) -Note that `detect_baron_samedit_cve-2021-3156_segfault_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_baron_samedit_cve-2021-3156_segfault_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ If sudoedit is throwing segfaults for other reasons this will pick those up too. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index 44487a919e..b199cbcbe9 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -27,59 +27,72 @@ During triage, confirm this is procdump.exe executing. If it is the first time a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-02-01 - **Author**: Michael Haag, Splunk - **ID**: 21276daa-663d-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -95,10 +108,10 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dump_lsass_via_procdump_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index d9c669bfab..741234e4b5 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -29,18 +29,19 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rundll32_application_control_bypass_-_advpack_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 430b89426e..9ed7164403 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -29,18 +29,19 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 61e7b44a-6088-4f26-b788-9a96ba13b37a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rundll32_application_control_bypass_-_setupapi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 2e7f7053f8..499d28c51f 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -29,18 +29,19 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_rundll32_application_control_bypass_-_syssetup_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 88eee8c950..38f657eacc 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -29,18 +29,19 @@ The following analytic identifies rundll32.exe executing a DLL function name, St - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 9319dda5-73f2-4d43-a85a-67ce961bddb7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe executing a DLL function name, St | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_rundll32_startw_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Although unlikely, some legitimate applications may use Start as a function and #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 128faa7591..022359a98f 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -29,18 +29,19 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-09 - **Author**: Michael Haag, Splunk - **ID**: 8c00a385-9b86-4ac0-8932-c9ec3713b159 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_rundll32_dllregisterserver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,7 +166,7 @@ This is likely to produce false positives and will require some filtering. Tune #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index dab07517df..7389ff250a 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -29,18 +29,19 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-11 - **Author**: Michael Haag, Splunk - **ID**: 723716de-ee55-4cd4-9759-c44e7e55ba4b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_html_help_spawn_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index 9a3e971df7..0ed0bf6012 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -29,18 +29,19 @@ The following analytic identifies regasm.exe spawning a process. This particular - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-12 - **Author**: Michael Haag, Splunk - **ID**: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies regasm.exe spawning a process. This particular | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies regasm.exe spawning a process. This particular #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regasm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index e2fa0fe5e1..b21be132e1 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -29,18 +29,19 @@ The following analytic identifies regsvcs.exe spawning a process. This particula - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-12 - **Author**: Michael Haag, Splunk - **ID**: bc477b57-5c21-4ab6-9c33-668772e7f114 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies regsvcs.exe spawning a process. This particula | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies regsvcs.exe spawning a process. This particula #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regsvcs_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md index 9e7350def7..f2b5767364 100644 --- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md @@ -35,17 +35,18 @@ This search looks for AWS CloudTrail events where a user created a policy versio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-02-22 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,43 +54,55 @@ This search looks for AWS CloudTrail events where a user created a policy versio | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -111,7 +124,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_create_policy_version_to_allow_all_resources_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md index 2e09028a17..71a536bbeb 100644 --- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md +++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md @@ -28,58 +28,71 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 5876d429-0240-4709-8b93-ea8330b411b5 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -95,10 +108,10 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cobalt_strike_named_pipes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index 4310c9c474..51d6763076 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -29,53 +29,66 @@ The following analytic identifies the use of a curl contacting suspicious remote - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 3f613dc0-21f2-4063-93b1-5d3c15eef22f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic identifies the use of a curl contacting suspicious remote #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_curl_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Unknown. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index f258f0a2ed..3a1aa8c4af 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -41,17 +41,18 @@ Upon triage, capture the property list file being written to disk and review for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: c3194009-e0eb-4f84-87a9-4070f8688f00 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -59,37 +60,49 @@ Upon triage, capture the property list file being written to disk and review for | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -105,10 +118,10 @@ Upon triage, capture the property list file being written to disk and review for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_plistbuddy_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index d14a0d9c9d..6684c596ef 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -40,17 +40,18 @@ Upon triage, capture the property list file being written to disk and review for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 20ba6c32-c733-4a32-b64e-2688cf231399 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,37 +59,49 @@ Upon triage, capture the property list file being written to disk and review for | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,7 +115,7 @@ Upon triage, capture the property list file being written to disk and review for The SPL above uses the following Macros: * [osquery_process](https://github.com/splunk/security_content/blob/develop/macros/osquery_process.yml) -Note that `suspicious_plistbuddy_usage_via_osquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_plistbuddy_usage_via_osquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Some legitimate applications may use PlistBuddy to create or modify property lis #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index d15b8db3c9..b5069a51cb 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -29,53 +29,66 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: e1997b2e-655f-4561-82fd-aeba8e1c1a86 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1074](https://attack.mitre.org/techniques/T1074/) | Data Staged | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_sqlite3_lsquarantine_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 483492201b..75e285b5c9 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -30,18 +30,19 @@ The following analytic identifies the use of PowerShell downloading a file using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 1a93b7ea-7af7-11eb-adb5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following analytic identifies the use of PowerShell downloading a file using | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -99,11 +112,11 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `any_powershell_downloadfile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ False positives may be present and filtering will need to occur by parent proces #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md index 30d451f734..193214488d 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md @@ -29,18 +29,19 @@ The following analytic identifies the use of PowerShell downloading a file using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 4d015ef2-7adf-11eb-95da-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies the use of PowerShell downloading a file using | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `any_powershell_downloadstring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ False positives may be present and filtering will need to occur by parent proces #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 6a67a7e7db..337c7b7e45 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -38,18 +38,19 @@ Upon triage, fodhelper.exe will have a child process and read access will occur - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 909f8fd8-7ac8-11eb-a1f3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -59,37 +60,49 @@ Upon triage, fodhelper.exe will have a child process and read access will occur | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -105,10 +118,10 @@ Upon triage, fodhelper.exe will have a child process and read access will occur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `fodhelper_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Limited to no false positives are expected. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index b5a04edd41..ad6d500487 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -29,18 +29,19 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 538d0152-7aaa-11eb-beaa-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ryuk_wake_on_lan_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Limited to no known false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 0c19efc092..58ebb99a88 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -33,18 +33,19 @@ The following detection identifies Scheduled Tasks registering (creating a new t - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 7feb7972-7ac3-11eb-bac8-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ The following detection identifies Scheduled Tasks registering (creating a new t | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ The following detection identifies Scheduled Tasks registering (creating a new t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_scheduled_task_from_public_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Limited false positives may be present. Filter as needed by parent process or co #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 1e8de148fa..e3c4503e8c 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -35,17 +35,18 @@ This search looks for AWS CloudTrail events where a user has set a default polic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-03-02 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0dac4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,43 +54,55 @@ This search looks for AWS CloudTrail events where a user has set a default polic | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_setdefaultpolicyversion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index d7f999b54c..0528d9497c 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -27,58 +27,71 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-02 - **Author**: Michael Haag, Splunk - **ID**: f1126df0-7bd5-11eb-988f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-26857](https://nvd.nist.gov/vuln/detail/CVE-2021-26857) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078. | 6.8 | +
#### Search @@ -94,10 +107,10 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `unified_messaging_service_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Unknown. Tune out child processes as needed to limit volume of false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index 8b0fbfed5e..6737213445 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -29,18 +29,19 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-02 - **Author**: Rod Soto, Jose Hernandez, Michael Haag, Splunk - **ID**: 23150a40-9301-4195-b802-5bb4f43067fb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_disableantispyware_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It is unusual to turn this feature off a Windows system since it is a default se #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 826652930b..6e230591f0 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -29,18 +29,19 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-03 - **Author**: Michael Haag, Splunk - **ID**: 1a382c6c-7c2e-11eb-ac69-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `nishang_powershelltcponeline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Limited false positives may be present. Filter as needed based on initial analys #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 2a016c5e58..e76edbf5a4 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -32,18 +32,19 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-03 - **Author**: Michael Haag, Splunk - **ID**: 0f03423c-7c6a-11eb-bc47-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,35 +52,46 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe | [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473) | Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-31206. | 10.0 | @@ -88,6 +100,7 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe +
#### Search @@ -103,12 +116,12 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `w3wp_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,7 +168,7 @@ Baseline your environment before production. It is possible build systems using #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index f270c12b39..d459b46915 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -27,53 +27,66 @@ The following analytics identifies a big number of instance of ransomware notes - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-03-12 - **Author**: Teoderick Contreras - **ID**: eff7919a-8330-11eb-83f8-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ The following analytics identifies a big number of instance of ransomware notes #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ransomware_notes_bulk_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -134,7 +147,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index 48408d5b23..188fc9f4a8 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -26,54 +26,67 @@ The following analytics identifies the resizing of shadowstorage by ransomware m - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-12 - **Author**: Teoderick Contreras - **ID**: bc760ca6-8336-11eb-bcbb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytics identifies the resizing of shadowstorage by ransomware m #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `resize_shadowstorage_volume_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.process @@ -134,7 +147,7 @@ network admin can resize the shadowstorage for valid purposes. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index 1192518690..e9a10ed2b3 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -27,53 +27,66 @@ This analytics are designed to indentify a high frequency of process termination - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-03-16 - **Author**: Teoderick Contreras - **ID**: 17cd75b2-8666-11eb-9ab4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytics are designed to indentify a high frequency of process termination #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `high_process_termination_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -130,7 +143,7 @@ admin or user tool that can terminate multiple process. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index b826edc305..5a565e980e 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -27,53 +27,66 @@ This search looks for high frequency of file deletion relative to process name a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-03-16 - **Author**: Teoderick Contreras - **ID**: 45b125c4-866f-11eb-a95a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search looks for high frequency of file deletion relative to process name a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_high_file_deletion_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -133,7 +146,7 @@ user may delete bunch of pictures or files in a folder. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index af42624020..dc7696c984 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -26,54 +26,67 @@ The following analytics are designed to identifies some CLOP ransomware variant - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 5a8a2a72-8322-11eb-9ee9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytics are designed to identifies some CLOP ransomware variant #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `clop_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Operators can execute third party tools using these parameters. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index 1b410a9060..8b7470b10f 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -28,53 +28,66 @@ This detection is to identify the common service name created by the CLOP ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-03-17 - **Author**: Teoderick Contreras - **ID**: 07e08a12-870c-11eb-b5f9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `clop_ransomware_known_service_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -131,7 +144,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index 0dfefcf224..892635bcec 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -26,54 +26,67 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-23 - **Author**: Michael Haag, Splunk - **ID**: bfe94226-8c10-11eb-a4b3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -Note that `certutil_with_decode_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Typically seen used to `encode` files, but it is possible to see legitimate use #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index d18b7c6ec8..2dc950dbf8 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -27,54 +27,67 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-29 - **Author**: Michael Haag, Splunk - **ID**: 39e2605a-90d8-11eb-899e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,11 +103,11 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `powershell_start-bitstransfer_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 91a397e75c..255d9f47a4 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -32,17 +32,18 @@ The following query uses IAM events to track the success of a group being delete - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-03-31 - **Author**: Michael Haag, Splunk - **ID**: e776d06c-9267-11eb-819b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ The following query uses IAM events to track the success of a group being delete | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_iam_successful_group_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ This detection will require tuning to provide high fidelity detection capabiltie #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 93d76c69b8..e68bcc78f8 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -29,18 +29,19 @@ This search is to identifies suspicious firewall disabling using netsh applicati - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-31 - **Author**: Teoderick Contreras, Splunk - **ID**: 6860a62c-9203-11eb-9e05-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identifies suspicious firewall disabling using netsh applicati | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to identifies suspicious firewall disabling using netsh applicati #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `disabling_firewall_with_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ admin may disable firewall during testing or fixing network problem. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index 65df11710a..206d347377 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -31,54 +31,67 @@ In addition to trust discovery, review parallel processes for additional behavio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-31 - **Author**: Michael Haag, Splunk - **ID**: cc316032-924a-11eb-91a2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ In addition to trust discovery, review parallel processes for additional behavio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dsquery_domain_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Limited false positives. If there is a true false positive, filter based on comm #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 2c06ce4480..45408a589f 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -29,17 +29,18 @@ The following detection identifies any malformed policy document exceptions with - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: f19e09b0-9308-11eb-b7ec-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following detection identifies any malformed policy document exceptions with | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_iam_assume_role_policy_brute_force_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ This detection will require tuning to provide high fidelity detection capabiltie #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index 5c29ee2be2..e3d7e22345 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -26,53 +26,66 @@ The following detection identifes when a policy is deleted on AWS. This does not - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: ec3a9362-92fe-11eb-99d0-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,7 +103,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_iam_delete_policy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,7 +140,7 @@ This detection will require tuning to provide high fidelity detection capabiltie #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 5f6253fa78..00e4683600 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -26,53 +26,66 @@ This detection identifies failure attempts to delete groups. We want to identify - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: 723b861a-92eb-11eb-93b8-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,7 +103,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_iam_failure_group_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,7 +140,7 @@ This detection will require tuning to provide high fidelity detection capabiltie #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index b687206e03..ff16833ce2 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -30,17 +30,18 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-07 - **Author**: Ryan Becwar - **ID**: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -105,7 +118,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `malicious_powershell_executed_as_a_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -146,7 +159,7 @@ Creating a hidden powershell service is rare and could key off of those instance #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index 75de20591f..e3ae03f1b1 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-08 - **Author**: Mauricio Velazco, Splunk - **ID**: 3a91a212-98a9-11eb-b86a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_users_failing_to_authenticate_from_host_using_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ A host failing to authenticate with multiple valid domain users is not a common #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index 1b9469da0a..4c59958230 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -37,17 +37,18 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-08 - **Author**: Michael Haag, Splunk - **ID**: 5d9c6eee-988c-11eb-8253-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,37 +56,49 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,10 +115,10 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winevent_scheduled_task_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ False positives are possible if legitimate applications are allowed to register #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 7a814af6f7..141c764a41 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -29,18 +29,19 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 42d40a22-9be3-11eb-8f08-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excel_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -141,7 +154,7 @@ False positives should be limited, but if any are present, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index b4da880395..7ad41cf22b 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -30,17 +30,18 @@ The following detection identifies Microsoft Excel spawning Windows Script Host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 57fe880a-9be3-11eb-9bf3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies Microsoft Excel spawning Windows Script Host | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following detection identifies Microsoft Excel spawning Windows Script Host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excel_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ False positives should be limited, but if any are present, filter as needed. In #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 5a72fbcbf7..2e40959111 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -37,17 +37,18 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 203ef0ea-9bd8-11eb-8201-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,37 +56,49 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,10 +115,10 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winevent_scheduled_task_created_to_spawn_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ False positives are possible if legitimate applications are allowed to register #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index 7499d3ccde..31522eb1c5 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -29,18 +29,19 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: b2c950b8-9be2-11eb-8658-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winword_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ False positives should be limited, but if any are present, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index 9a72ff7e4a..f1f4f8875e 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -30,17 +30,18 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 637e1b5c-9be1-11eb-9c32-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winword_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ There will be limited false positives and it will be different for every environ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 0ed70cc819..f2c20b14e6 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -26,59 +26,72 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-13 - **Author**: Patrick Bareiss, Splunk - **ID**: 1fdd164a-def8-4762-83a9-9ffe24e74d5a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_excessive_security_scanning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ While this search has no known false positives. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 031d01c0ed..8637512555 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 7ed272a4-9c77-11eb-af22-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ A host failing to authenticate with multiple valid domain users is not a common #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 83aa7856e5..6999e763dd 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 9015385a-9c84-11eb-bef2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,7 +115,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `multiple_users_failing_to_authenticate_from_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_users_failing_to_authenticate_from_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ A process failing to authenticate with multiple users is not a common behavior f #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index e20867c609..fbe1690b51 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 80f9d53e-9ca1-11eb-b0d6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `multiple_users_remotely_failing_to_authenticate_from_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_users_remotely_failing_to_authenticate_from_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ A host failing to authenticate with multiple valid users against a remote host i #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index c13138fbfd..9fe96c948b 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -29,18 +29,19 @@ this detection was designed to identifies suspicious spawned process of known MS - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 958751e4-9c5f-11eb-b103-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this detection was designed to identifies suspicious spawned process of known MS | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_application_spawn_rundll32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -143,7 +156,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md index 07d87446b6..52c3907f07 100644 --- a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md +++ b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: e61918fa-9ca4-11eb-836c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `windows_users_authenticate_using_explicit_credentials_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_users_authenticate_using_explicit_credentials_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ A source user failing attempting to authenticate multiple users on a host is not #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index ddce7f149a..e1df7ecf2f 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -30,17 +30,18 @@ this search detects a potential malicious office document that create schedule t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-14 - **Author**: Teoderick Contreras, Splunk - **ID**: cc8b7b74-9d0f-11eb-8342-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search detects a potential malicious office document that create schedule t | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ this search detects a potential malicious office document that create schedule t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_document_creating_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * ImageLoaded @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index eb250a2149..712dd21be0 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -30,17 +30,18 @@ this detection was designed to identifies suspicious office documents that using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-14 - **Author**: Teoderick Contreras, Splunk - **ID**: b12c89bc-9d06-11eb-a592-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this detection was designed to identifies suspicious office documents that using | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ this detection was designed to identifies suspicious office documents that using #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_document_executing_macro_code_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * ImageLoaded @@ -138,7 +151,7 @@ Normal Office Document macro use for automation #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md index cce91a2cec..753a1faabf 100644 --- a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md +++ b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-14 - **Author**: Mauricio Velazco, Splunk - **ID**: 98f22d82-9d62-11eb-9fcf-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `windows_disabled_users_failing_to_authenticate_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disabled_users_failing_to_authenticate_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ A host failing to authenticate with multiple disabled domain users is not a comm #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md index 8ba7ac47f0..07181f8a47 100644 --- a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md +++ b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-14 - **Author**: Mauricio Velazco, Splunk - **ID**: 001266a6-9d5b-11eb-829b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `windows_invalid_users_failed_authentication_via_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_invalid_users_failed_authentication_via_kerberos_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index 949fc506c6..ed23e6ccca 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -26,54 +26,67 @@ this search is to detect potential DNS exfiltration using nslookup application. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-15 - **Author**: Teoderick Contreras, Splunk - **ID**: 2452e632-9e0d-11eb-bacd-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ this search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dns_exfiltration_using_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ admin nslookup usage #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index 9fdc2a9c7e..3254d7e5dc 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -32,17 +32,18 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-04-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 57ad5a64-9df7-11eb-a290-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The analytics returned fields allow analysts to investigate the event further by | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The analytics returned fields allow analysts to investigate the event further by The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ A host failing to authenticate with multiple invalid domain users is not a commo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index e9a27cde1e..81a76ff8c8 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -28,53 +28,66 @@ this search is designed to detect suspicious powershell process that tries to in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ec102cb2-a0f5-11eb-9b38-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ this search is designed to detect suspicious powershell process that tries to in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `powershell_remote_thread_to_known_windows_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 4ed2a275b3..21a66d2af0 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -29,53 +29,66 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 523c2684-a101-11eb-916b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schedule_task_with_http_command_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 8be8842cb1..4b63079399 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -29,53 +29,66 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 75b00fd8-a0ff-11eb-8b31-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schedule_task_with_rundll32_command_trigger_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index 774fad5e1d..41f98dbe17 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -30,17 +30,18 @@ this search is designed to detect suspicious wermgr.exe process that tries to co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ed313326-a0f9-11eb-a89c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is designed to detect suspicious wermgr.exe process that tries to co | [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ this search is designed to detect suspicious wermgr.exe process that tries to co #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wermgr_process_connecting_to_ip_check_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index fd88fd6af5..ba6c575f79 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -27,53 +27,66 @@ this search is designed to detect potential malicious wermgr.exe process that dr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ab3bcce0-a105-11eb-973c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ this search is designed to detect potential malicious wermgr.exe process that dr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wermgr_process_create_executable_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index c0833c4a1d..1b30cb681b 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -26,54 +26,67 @@ This search is designed to detect suspicious cmd and powershell process spawned - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: e8fc95bc-a107-11eb-a978-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,12 +102,12 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wermgr_process_spawned_cmd_or_powershell_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 28923e48fb..1c79405b19 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -27,53 +27,66 @@ This search is to detect potential DNS exfiltration using nslookup application. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-21 - **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk - **ID**: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect potential DNS exfiltration using nslookup application. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_usage_of_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index 57a8c9e684..d753d5416f 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -30,17 +30,18 @@ This search is designed to detect high frequency of archive files data exfiltrat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2021-04-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 4477f3ea-a28f-11eb-b762-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is designed to detect high frequency of archive files data exfiltrat | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,7 +112,7 @@ The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `multiple_archive_files_http_post_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Normal archive transfer via HTTP protocol may trip this detection. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index 9386c28132..e9cc22551c 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -29,18 +29,19 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Teoderick Contreras, Splunk - **ID**: 9364ee8e-a39a-11eb-8f1d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh | [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `anomalous_usage_of_7zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ False positives should be limited as this behavior is not normal for `rundll32.e #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index ba86f5b45c..0e60a65f2b 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -29,18 +29,19 @@ The following detection identifies the latest behavior utilized by IcedID malwar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Splunk - **ID**: c661f6be-a38c-11eb-be57-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies the latest behavior utilized by IcedID malwar | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_product_spawning_rundll32_with_no_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited, but if any are present, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index a44d9fcdac..d0977c1006 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -30,17 +30,18 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2021-04-22 - **Author**: Teoderick Contreras, Splunk - **ID**: e2b36208-a364-11eb-8909-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ The SPL above uses the following Macros: * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `plain_http_post_exfiltrated_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 86245a0cbc..f4e613f6c4 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -29,18 +29,19 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Splunk - **ID**: 6fcbaedc-a37b-11eb-956b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winword_spawning_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ False positives should be limited, but if any are present, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 494b1abf04..0e0916d061 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -29,18 +29,19 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: e8c591f4-a6d7-11eb-8cf7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies the latest behavior utilized by different mal | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_product_spawning_bitsadmin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ No false positives known. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index b445c9b843..b0766c7f02 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -29,18 +29,19 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: 6925fe72-a6d5-11eb-9e17-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies the latest behavior utilized by different mal | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -Note that `office_product_spawning_certutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ No false positives known. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index 9e3f2173f8..ec978ba92b 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -29,18 +29,19 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: 6078fa20-a6d2-11eb-b662-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies the latest behavior utilized by different mal | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that `office_product_spawning_mshta_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ No false positives known. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index 538699946d..0eadc14902 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -28,53 +28,66 @@ this search is to detect potential trickbot infection through the create/connect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 1804b0a4-a682-11eb-8f68-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ this search is to detect potential trickbot infection through the create/connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `trickbot_named_pipe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index a8eb5a661a..1a44f88cfd 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -26,54 +26,67 @@ This analytic identifies a potential adversary that changes the security permiss - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: cf8d753e-a8fe-11eb-8f58-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies a potential adversary that changes the security permiss #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `icacls_deny_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index b0eb6bfa5e..4639b50b53 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -32,17 +32,18 @@ This analytic will detect suspicious driver loaded paths. This technique is comm - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: f880acd4-a8f1-11eb-a53b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic will detect suspicious driver loaded paths. This technique is comm | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic will detect suspicious driver loaded paths. This technique is comm #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_driver_loaded_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Limited false positives will be present. Some applications do load drivers #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 19f94a1727..a8ebca20c2 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -32,17 +32,18 @@ This analytic identifies XMRIG coinminer driver installation on the system. The - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 90080fa6-a8df-11eb-91e4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic identifies XMRIG coinminer driver installation on the system. The | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic identifies XMRIG coinminer driver installation on the system. The #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `xmrig_driver_loaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ False positives should be limited. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index 657319715f..d1e7071bbe 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -26,54 +26,67 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 1c8c6f66-acce-11eb-aafb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `deleting_of_net_users_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ System administrators or scripts may delete user accounts via this technique. Fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 1597b0afce..52b011b607 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -26,54 +26,67 @@ This analytic will identify a suspicious command-line that disables a user accou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: c0325326-acd6-11eb-98c2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `disabling_net_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index 1f0767bef5..5ed2cfa27c 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -26,54 +26,67 @@ This analytic will identify suspicious series of command-line to disable several - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 8fa2a0f0-acd9-11eb-8994-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic will identify suspicious series of command-line to disable several #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_attempt_to_disable_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index db6549088f..38f4430c31 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -26,54 +26,67 @@ This analytic identifies suspicious series of attempt to kill multiple services - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: ae8d3f4a-acd7-11eb-8846-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_service_stop_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index aec923effa..bff59e613c 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -29,18 +29,19 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: fe5bca48-accb-11eb-a67c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_usage_of_taskkill_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Unknown. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index 88a68c9306..79dbc6a308 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -26,54 +26,67 @@ This analytic identifies potential adversaries that modify the security permissi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: b1b1e316-accc-11eb-a9b4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies potential adversaries that modify the security permissi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `icacls_grant_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Unknown. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md index 112f183039..5e0c4be05a 100644 --- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md @@ -26,54 +26,67 @@ This analytic identifies suspicious modification of ACL permission to a files or - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 7e8458cc-acca-11eb-9e3f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies suspicious modification of ACL permission to a files or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `modify_acl_permission_to_files_or_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ administrators may use this command. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 096d7c9dbb..240d794365 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -29,18 +29,19 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ffaa42c-acdb-11eb-9ad3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `process_kill_base_on_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 0cddee415e..3d9d50e3f1 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -27,54 +27,67 @@ The following analytic will detect a suspicious process running in a file path w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-05 - **Author**: Teoderick Contreras, Splunk - **ID**: 9be25988-ad82-11eb-a14f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ The following analytic will detect a suspicious process running in a file path w #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Administrators may allow execution of specific binaries in non-standard paths. F #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index 3bead05ec9..552c212ffa 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -27,53 +27,66 @@ The following analytic will identify a suspicious download by the Telegram appli - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 58194e28-ae5e-11eb-8912-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ The following analytic will identify a suspicious download by the Telegram appli #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `download_files_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ normal download of file in telegram app. (if it was a common app in network) #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index bd5f79572f..31daed681e 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -27,53 +27,66 @@ This analytic will detect a suspicious Telegram process enumerating all network - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: fcd74532-ae54-11eb-a5ab-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `enumerate_users_local_group_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 22c07747cf..dc1591bc82 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -26,54 +26,67 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 45e52536-ae42-11eb-b5c6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1531](https://attack.mitre.org/techniques/T1531/) | Account Access Removal | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_usage_of_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown. Filter as needed. Modify the time span as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index cf2787d3ee..92612ec430 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -26,54 +26,67 @@ This analytic will identify suspicious executable or scripts (known file extensi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: a7e3f0f0-ae42-11eb-b245-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic will identify suspicious executable or scripts (known file extensi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `executables_or_script_creation_in_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 4256e1e484..172b4f0ac3 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -26,54 +26,67 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-07 - **Author**: Teoderick Contreras, Splunk - **ID**: 0bdf6092-af17-11eb-939a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_usage_of_cacls_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or administrative scripts may use this application. Filter as nee #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index 1c4072242a..2b6feaaaa9 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -28,54 +28,67 @@ This analytic identifies an on demand run of a Windows Schedule Task through she - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-07 - **Author**: Teoderick Contreras, Splunk - **ID**: bb37061e-af1f-11eb-a159-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ This analytic identifies an on demand run of a Windows Schedule Task through she #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schtasks_run_task_on_demand_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators may use to debug Schedule Task entries. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index f4b3414d57..223abd9485 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -27,53 +27,66 @@ This following analytic detects PowerShell command to delete shadow copy using t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `delete_shadowcopy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 41ee228fad..5f00a8936a 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -30,17 +30,18 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-13 - **Author**: Teoderick Contreras, Splunk - **ID**: f87b5062-b405-11eb-a889-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cmlua_or_cmstplua_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Legitimate windows application that are not on the list loading this dll. Filter #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index 0e7f4cd6bd..ad740ff550 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -31,18 +31,19 @@ The following analytic identifies the Microsoft Software Licensing User Interfac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-13 - **Author**: Michael Haag, Splunk - **ID**: 8d124810-b3e4-11eb-96c7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The following analytic identifies the Microsoft Software Licensing User Interfac | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `slui_runas_elevated_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Limited false positives should be present as this is not commonly used by legiti #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 51eb13f68a..37ae2ee3f5 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -31,18 +31,19 @@ The following analytic identifies the Microsoft Software Licensing User Interfac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-13 - **Author**: Michael Haag, Splunk - **ID**: 879c4330-b3e0-11eb-b1b1-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The following analytic identifies the Microsoft Software Licensing User Interfac | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies the Microsoft Software Licensing User Interfac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `slui_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Certain applications may spawn from `slui.exe` that are legitimate. Filtering wi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 949319067d..054ab7177a 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -27,54 +27,67 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-18 - **Author**: Michael Haag, Splunk - **ID**: c448488c-b7ec-11eb-8253-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `services_escalate_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ False positives should be limited as `services.exe` should never spawn a process #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index 113c481eb7..35b71e522a 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -30,17 +30,18 @@ The following analytic identifies suspicious PowerShell command to allow inbound - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-19 - **Author**: Teoderick Contreras, Splunk - **ID**: a5d85486-b89c-11eb-8267-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies suspicious PowerShell command to allow inbound | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `allow_inbound_traffic_in_firewall_rule_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **allow_inbound_traffic_in_firewall_rule_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ administrator may allow inbound traffic in certain network or machine. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index 022c684f31..d5bb1e9705 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -30,17 +30,18 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-19 - **Author**: Teoderick Contreras, Splunk - **ID**: a36972c8-b894-11eb-9f78-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T | [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `mailsniper_invoke_functions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index c0ab2f0cac..a212374fdf 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -37,18 +37,19 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-20 - **Author**: Michael Haag, Splunk - **ID**: eb277ba0-b96b-11eb-b00e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -60,37 +61,49 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks | [T1543](https://attack.mitre.org/techniques/T1543/) | Create or Modify System Process | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -106,11 +119,11 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cmd_echo_pipe_-_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,7 +167,7 @@ Unknown. It is possible filtering may be required to ensure fidelity. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 70cf61285e..6c50a0ad1c 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -30,58 +30,71 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-21 - **Author**: Drew Church, Michael Haag, Splunk - **ID**: a081836a-ba4d-11eb-8593-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation * Actions on Objectives +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-31166](https://nvd.nist.gov/vuln/detail/CVE-2021-31166) | HTTP Protocol Stack Remote Code Execution Vulnerability | 7.5 | +
#### Search @@ -97,10 +110,10 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winrm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Unknown. Add new processes or filter as needed. It is possible system management #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index 1fd100fa84..5ede6720a5 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -29,18 +29,19 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 5672819c-be09-11eb-bbfb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `secretdumps_offline_ntds_dumping_tool_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index cb9e9107fe..a65e888144 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -45,17 +45,18 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-05-27 - **Author**: Michael Haag, Splunk - **ID**: 42b4b438-beed-11eb-ba1d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -73,37 +74,49 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -119,10 +132,10 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_sharphound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -164,7 +177,7 @@ False positives should be limited as the analytic is specific to a filename with #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 1a51e9b03c..3f19325d68 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -44,18 +44,19 @@ The following analytic identifies SharpHound binary usage by using the original - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-27 - **Author**: Michael Haag, Splunk - **ID**: dd04b29a-beed-11eb-87bc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -73,37 +74,49 @@ The following analytic identifies SharpHound binary usage by using the original | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -119,10 +132,10 @@ The following analytic identifies SharpHound binary usage by using the original #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_sharphound_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -170,7 +183,7 @@ False positives should be limited as this is specific to a file attribute not us #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 432302acfa..5e255baf5d 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -44,18 +44,19 @@ The following analytic identifies the common command-line argument used by Azure - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: 26f02e96-c300-11eb-b611-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -73,37 +74,49 @@ The following analytic identifies the common command-line argument used by Azure | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -119,10 +132,10 @@ The following analytic identifies the common command-line argument used by Azure #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_azurehound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -168,7 +181,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index 569bfa9e11..7037ea35b7 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -45,17 +45,18 @@ The following analytic is similar to SharpHound file modifications, but this ins - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: 1c34549e-c31b-11eb-996b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -73,37 +74,49 @@ The following analytic is similar to SharpHound file modifications, but this ins | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -119,10 +132,10 @@ The following analytic is similar to SharpHound file modifications, but this ins #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_azurehound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,7 +173,7 @@ False positives should be limited as the analytic is specific to a filename with #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index 3fafd776c5..3c7a631b60 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -44,18 +44,19 @@ The following analytic identifies common command-line arguments used by SharpHou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: a0bdd2f6-c2ff-11eb-b918-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -73,37 +74,49 @@ The following analytic identifies common command-line arguments used by SharpHou | [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -119,10 +132,10 @@ The following analytic identifies common command-line arguments used by SharpHou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_sharphound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -166,7 +179,7 @@ False positives should be limited as the arguments used are specific to SharpHou #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 0950401ee6..d6723b7f04 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -26,54 +26,67 @@ This search detects the suspicious commandline argument of revil ransomware to e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 624919bc-c382-11eb-adcc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search detects the suspicious commandline argument of revil ransomware to e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `conti_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ To successfully implement this search, you need to be ingesting logs with the pr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index 4677c29645..b11235853d 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -27,53 +27,66 @@ This analytic identifies suspicious modification of registry to deface or change - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: accb0712-c381-11eb-8e5b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1491](https://attack.mitre.org/techniques/T1491/) | Defacement | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ This analytic identifies suspicious modification of registry to deface or change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `modification_of_wallpaper_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ To successfully implement this search, you need to be ingesting logs with the Im #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index 22b59cdf30..26fa5f1342 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -26,54 +26,67 @@ This analytic identifies suspicious commandline parameter that are commonly used - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 85facebe-c382-11eb-9c3e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies suspicious commandline parameter that are commonly used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `revil_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ third party tool may have same command line parameters as revil ransomware. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index ab5125c741..b2016bf0c5 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -30,17 +30,18 @@ this search is designed to detect potential malicious process loading COM object - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 9d911ce0-c3be-11eb-b177-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is designed to detect potential malicious process loading COM object | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ this search is designed to detect potential malicious process loading COM object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wbemprox_com_object_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ legitimate process that are not in the exception list may trigger this event. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index b79debb106..8955a7020a 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -27,53 +27,66 @@ This search detects a suspicioous termination of known services killed by ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 3070f8e0-c528-11eb-b2a0-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,7 +104,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `known_services_killed_by_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ Admin activities or installing related updates may do a sudden stop to list of s #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index c0338ba820..170d22adf3 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -26,54 +26,67 @@ This detection targets behaviors observed in post exploit kits like Meterpreter - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) - **Last Updated**: 2021-06-07 - **Author**: Michael Hart - **ID**: f443dac2-c7cf-11eb-ab51-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This detection targets behaviors observed in post exploit kits like Meterpreter #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_number_of_taskhost_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Administrators, administrative actions or certain applications may run many inst #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index 3273c769f4..8c9ae70415 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -36,17 +36,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-08 - **Author**: Michael Haag, Splunk - **ID**: a26d9db4-c883-11eb-9d75-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -56,37 +57,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,10 +114,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_fileless_process_injection_via_getprocaddress_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Limited false positives. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index 701dcb14c5..6e66ab517b 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -35,17 +35,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-08 - **Author**: Michael Haag, Splunk - **ID**: 8acbc04c-c882-11eb-b060-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,37 +56,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,10 +113,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_fileless_script_contains_base64_encoded_content_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index 523a907b87..e8fbfb40e6 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -31,17 +31,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: bc1dc6b8-c954-11eb-bade-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `detect_empire_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives may only pertain to it not being related to Empire, but another #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index 87727c216a..eaafafc484 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -28,53 +28,66 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: 8148c29c-c952-11eb-9255-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `detect_mimikatz_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ False positives should be limited as the commands being identifies are quite spe #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 5b1f13ad68..f86c478a01 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -28,53 +28,66 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: a21e3484-c94d-11eb-b55b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `unloading_amsi_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unloading_amsi_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 16dc7377a3..f0d527ce43 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -29,18 +29,19 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: cd80a6ac-c9d9-11eb-8839-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `clear_unallocated_sector_using_cipher_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ administrator may execute this app to manage disk #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index 1a4f00dccb..6f2b1af284 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -29,18 +29,19 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 236e7c8e-c9d9-11eb-a824-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `disable_logs_using_wevtutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ network operator may disable audit event logs for debugging purposes. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index c63e945993..dbc2ab8cb9 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -26,54 +26,67 @@ This search is to detect a modification of file or directory permission using ta - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a modification of file or directory permission using ta #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `permission_modification_using_takeown_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ takeown.exe is a normal windows application that may used by network operator. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 8fff95284f..9fbef4241b 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -29,17 +29,18 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 637557ec-ca08-11eb-bd0a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic identifies suspicious PowerShell script execution via Eve | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_creating_thread_mutex_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ powershell developer may used this function in their script for instance checkin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 20a79f1e34..1a896fe8a1 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -31,17 +31,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Michael Haag, Splunk - **ID**: e1866ce2-ca22-11eb-8e44-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_domain_enumeration_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ It is possible there will be false positives, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md index e5e89060d6..3df985da79 100644 --- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -31,17 +31,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Michael Haag, Splunk - **ID**: 85bc3f30-ca28-11eb-bd21-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_loading_dotnet_into_memory_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives should be limited as day to day scripts do not use this method. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index 6284a8ec3c..0f8fdaae2b 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -29,17 +29,18 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 0d718b52-c9f1-11eb-bc61-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic identifies suspicious PowerShell script execution via Eve | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_processing_stream_of_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ powershell may used this function to process compressed data. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md index be3882f438..1992e2d82f 100644 --- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md @@ -26,53 +26,66 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: c396a0c4-c9f2-11eb-b4f5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1140](https://attack.mitre.org/techniques/T1140/) | Deobfuscate/Decode Files or Information | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_using_memory_as_backing_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_using_memory_as_backing_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ powershell may used this function to store out object into memory. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 1ed430f12c..5ba60d93de 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -26,54 +26,67 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 7742aa92-c9d9-11eb-bbfc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `prevent_automatic_repair_mode_using_bcdedit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators may modify the boot configuration ignore failure during testing a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md index f9b9634a2d..6a7a13626e 100644 --- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md @@ -26,53 +26,66 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 28077620-c9f6-11eb-8785-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `recon_avproduct_through_pwh_or_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **recon_avproduct_through_pwh_or_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ network administrator may used this command for checking purposes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 0a59bde416..a8f8c56e64 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -26,53 +26,66 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 018c1972-ca07-11eb-9473-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `recon_using_wmi_class_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ network administrator may used this command for checking purposes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 4e02a62420..bc0beef41e 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -26,53 +26,66 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-14 - **Author**: Teoderick Contreras, Splunk - **ID**: b5cd5526-cce7-11eb-b3bd-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `wmi_recon_running_process_or_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ network administrator may used this command for checking purposes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index 595099141a..986c97fc50 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -36,17 +36,18 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-16 - **Author**: Michael Haag, Splunk - **ID**: 01d9a0c2-cece-11eb-ab46-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,37 +55,49 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,10 +112,10 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_wmi_event_subscription_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It is possible some applications will create a consumer and may be required to b #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index c588fd34d5..8173d871c1 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -29,17 +29,18 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-06-17 - **Author**: Mauricio Velazco, Splunk - **ID**: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,21 +48,27 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e | [T1070.001](https://attack.mitre.org/techniques/T1070/001/) | Clear Windows Event Logs | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * PR.IP * PR.AC @@ -70,24 +77,30 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 6 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_event_log_service_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ It is possible the Event Logging service gets shut down due to system errors or #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index 747a843bc5..93f0cb6512 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -29,18 +29,19 @@ This analytic will identify suspicious process of cscript.exe where it tries to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: dc64d064-d346-11eb-8588-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic will identify suspicious process of cscript.exe where it tries to | [T1059.005](https://attack.mitre.org/techniques/T1059/005/) | Visual Basic | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic will identify suspicious process of cscript.exe where it tries to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `execute_javascript_with_jscript_com_clsid_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 09f7bd6d2a..a9de1620c3 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -30,17 +30,18 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: afed80b2-d34b-11eb-a952-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe | [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_enable_smb1protocol_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ network operator may enable or disable this windows feature. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index 1ecee866cb..c37b21d104 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -29,18 +29,19 @@ This search is to detect a suspicious commandline designed to delete files or di - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: ba570b3a-d356-11eb-8358-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious commandline designed to delete files or di | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `recursive_delete_of_directory_in_batch_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ network operator may use this batch command to delete recursively a directory or #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index f99b8569e3..bf45950160 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -29,18 +29,19 @@ This search is to detect a suspicious modification of firewall to allow file and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-23 - **Author**: Teoderick Contreras, Splunk - **ID**: ce27646e-d411-11eb-8a00-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious modification of firewall to allow file and | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a suspicious modification of firewall to allow file and #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `allow_file_and_printing_sharing_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ network admin may modify this firewall feature that may cause this rule to be tr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index ea402c9736..a5a9cc2a68 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -29,18 +29,19 @@ This search is to detect a suspicious modification to the firewall to allow netw - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-23 - **Author**: Teoderick Contreras, Splunk - **ID**: ccd6a38c-d40b-11eb-85a5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious modification to the firewall to allow netw | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a suspicious modification to the firewall to allow netw #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `allow_network_discovery_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ network admin may modify this firewall feature that may cause this rule to be tr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index 2a5475e767..12b22c558f 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -30,17 +30,18 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-06-24 - **Author**: Teoderick Contreras, Splunk - **ID**: cb6b339e-d4c6-11eb-a026-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_usage_of_sc_service_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index 0e882e2a4a..6671a1b142 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -29,18 +29,19 @@ This detection targets behaviors observed when threat actors have used sc.exe to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-25 - **Author**: Michael Hart, Splunk - **ID**: 77592bec-d5cc-11eb-9e60-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This detection targets behaviors observed when threat actors have used sc.exe to | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This detection targets behaviors observed when threat actors have used sc.exe to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_number_of_service_control_start_as_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Legitimate programs and administrators will execute sc.exe with the start disabl #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index f53943a31c..39e80769c2 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -36,17 +36,18 @@ During triage, isolate the endpoint and review for source of exploitation. Captu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: 313681a2-da8e-11eb-adad-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,35 +55,46 @@ During triage, isolate the endpoint and review for source of exploitation. Captu | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | @@ -90,6 +102,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu +
#### Search @@ -104,10 +117,10 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `print_spooler_adding_a_printer_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Unknown. This may require filtering. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 9ba9a99d74..83cbd2e90b 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -37,17 +37,18 @@ During triage, isolate the endpoint and review for source of exploitation. Captu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 1adc9548-da7c-11eb-8f13-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,35 +56,46 @@ During triage, isolate the endpoint and review for source of exploitation. Captu | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | @@ -91,6 +103,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu +
#### Search @@ -105,10 +118,10 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `print_spooler_failed_to_load_a_plug-in_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ False positives are unknown and filtering may be required. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 79615faaaf..ea46591f80 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -32,18 +32,19 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 15d905f6-da6b-11eb-ab82-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,41 +52,53 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -102,10 +115,10 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `spoolsv_spawning_rundll32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Limited false positives have been identified. There are limited instances where #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index a37591c3db..3a912ebefc 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -33,17 +33,18 @@ This search is to detect suspicious loading of dll in specific path relative to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: a5e451f8-da81-11eb-b245-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,41 +52,53 @@ This search is to detect suspicious loading of dll in specific path relative to | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -101,10 +114,10 @@ This search is to detect suspicious loading of dll in specific path relative to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `spoolsv_suspicious_loaded_modules_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index 39264d494e..f549313207 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -28,57 +28,70 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: 799b606e-da81-11eb-93f8-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -93,10 +106,10 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `spoolsv_suspicious_process_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Unknown. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index 272d5211f2..644dbc96bc 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -32,18 +32,19 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: d5bf5cf2-da71-11eb-92c2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,41 +52,53 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -107,7 +120,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `spoolsv_writing_a_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spoolsv_writing_a_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index 0750200820..f6d5b756f5 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -33,17 +33,18 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 347fd388-da87-11eb-836d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,41 +52,53 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -100,10 +113,10 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `spoolsv_writing_a_dll_-_sysmon_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Limited false positives. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 401598e9a5..421a6bb7bf 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -33,18 +33,19 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-05 - **Author**: Teoderick Contreras, Splunk - **ID**: 8bb3f280-dd9b-11eb-84d5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `msmpeng_application_dll_side_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ quite minimal false positive expected. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index f3c27960ca..24bde173fb 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -29,18 +29,19 @@ This search is to identifies a modification in registry to disable the windows d - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-05 - **Author**: Michael Haag, Splunk - **ID**: c148a894-dd93-11eb-bf2a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identifies a modification in registry to disable the windows d | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `powershell_disable_security_monitoring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Limited false positives. However, tune based on scripts that may perform this ac #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index 036ddf2ab8..cf52d7e01a 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -32,17 +32,18 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 7f04349c-e30d-11eb-bc7f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `uac_bypass_mmc_load_unsigned_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown. all of the dll loaded by mmc.exe is microsoft signed dll. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index 2bbdcd1426..8c47f9ca87 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -35,18 +35,19 @@ This search looks for cloud compute instances created by users who have not crea - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) -- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) +- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2021-07-13 - **Author**: Rico Valdez, Splunk - **ID**: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,41 +55,53 @@ This search looks for cloud compute instances created by users who have not crea | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * ID.AM +
CIS20 +
+ * CIS 1 +
CVE +
+
#### Search @@ -109,10 +122,10 @@ This search looks for cloud compute instances created by users who have not crea #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cloud_compute_instance_created_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -150,7 +163,7 @@ It's possible that a user will start to create compute instances for the first t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index 6def57d3f1..f800e58822 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-07-19 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf444d111 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -106,7 +119,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_createloginprofile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index 9247864b78..364ee513a4 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -26,59 +26,72 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-07-19 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_open_s3_buckets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index 7914ee07d6..a3c79a5700 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -26,59 +26,72 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-07-19 - **Author**: Patrick Bareiss, Splunk - **ID**: 39c61d09-8b30-4154-922b-2d0a694ecc22 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -98,7 +111,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_new_open_s3_buckets_over_aws_cli_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 321a589112..a9418ae34e 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -29,18 +29,19 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 4aa5d062-e893-11eb-9eb2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,12 +107,12 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `mshta_spawning_rundll32_or_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ limitted. this anomaly behavior is not commonly seen in clean host. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index 6af2b9bdc6..239eaa9ad5 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -29,18 +29,19 @@ this search is to detect a suspicious office product process that spawn cmd chil - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-19 - **Author**: Teoderick Contreras, Splunk - **ID**: b8b19420-e892-11eb-9244-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to detect a suspicious office product process that spawn cmd chil | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_product_spawn_cmd_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ IT or network admin may create an document automation that will run shell script #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index d1c8ef82fd..a7b9c87d6f 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -26,59 +26,72 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-07-20 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `detect_shared_ec2_snapshot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_shared_ec2_snapshot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ It is possible that an AWS admin has legitimately shared a snapshot with others #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index 8f8a9527ae..e58a9b76a6 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -32,17 +32,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-07-21 - **Author**: Michael Haag, Splunk - **ID**: 9251299c-ea5b-11eb-a8de-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,41 +51,53 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 | +
#### Search @@ -99,10 +112,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `detect_copy_of_shadowcopy_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_copy_of_shadowcopy_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hive #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index 70a697fbc1..c157819162 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -31,17 +31,18 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-23 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: 57551656-ebdb-11eb-afdf-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-36934](https://nvd.nist.gov/vuln/detail/CVE-2021-36934) | Windows Elevation of Privilege Vulnerability | 4.6 | +
#### Search @@ -98,7 +111,7 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `sam_database_file_access_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sam_database_file_access_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Natively, `dllhost.exe` will access the files. Every environment will have addit #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index f115fed5c1..c56733a83c 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -28,53 +28,66 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: f8a22586-ee2d-11eb-a193-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_createremotethread_in_browser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index b3eff4b80e..dc22f72471 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -30,17 +30,18 @@ This search is to detect a suspicious rundll32 process that drops executable (.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 6338266a-ee2a-11eb-bf68-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious rundll32 process that drops executable (.e | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious rundll32 process that drops executable (.e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_process_creating_exe_dll_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 49342069f4..99dd65d479 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -29,18 +29,19 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: bed761f8-ee29-11eb-8bf3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_icedid_rundll32_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ limitted. this parameter is not commonly used by windows application but can be #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 3553f291ca..b4917c9792 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -29,18 +29,19 @@ This search is to detect a suspicious rundll32.exe process with plugininit param - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 92d51712-ee29-11eb-b1ae-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious rundll32.exe process with plugininit param | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_rundll32_plugininit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ third party application may used this dll export name to execute function. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index b40cce8ae2..fced024e03 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -27,53 +27,66 @@ This search is to detect execution of chcp.exe application. this utility is used - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 21d236ec-eec1-11eb-b23e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect execution of chcp.exe application. this utility is used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `chcp_command_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ other tools or script may used this to change code page to UTF-* or others #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index a3804a21a9..2143f4cde2 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -29,18 +29,19 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-27 - **Author**: Teoderick Contreras, Splunk - **ID**: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `regsvr32_with_known_silent_switch_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ minimal. but network operator can use this application to load dll. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index dd44eda3f2..537bb14e8d 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -28,53 +28,66 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 2dbeee3a-f067-11eb-96c0-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_create_remote_thread_to_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index 63cd481f04..dab7ce0922 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -30,17 +30,18 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: b7a045fc-f14a-11eb-8e79-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `drop_icedid_license_dat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index ccc3e1c020..74c84eaf29 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -30,17 +30,18 @@ This search is to detect a suspicious file creation namely passff.tar and cookie - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: 0db4da70-f14b-11eb-8043-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious file creation namely passff.tar and cookie | [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious file creation namely passff.tar and cookie #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `icedid_exfiltrated_archived_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index a00ba400e7..39d676b24b 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -29,18 +29,19 @@ this detection was designed to identifies suspicious spawned process of known MS - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: 2d9fc90c-f11f-11eb-9300-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this detection was designed to identifies suspicious spawned process of known MS | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `office_application_spawn_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index dc6b807ee7..8af853fd04 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -27,53 +27,66 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-03 - **Author**: Teoderick Contreras, Splunk - **ID**: 0f216a38-f45f-11eb-b09c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1005](https://attack.mitre.org/techniques/T1005/) | Data from Local System | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `sqlite_module_in_temp_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index a97e404d7f..0b9dd66eb8 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -28,53 +28,66 @@ This search is to detect suspicious process injection in command shell. This tec - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 10399c1e-f51e-11eb-b920-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect suspicious process injection in command shell. This tec #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `create_remote_thread_in_shell_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 1da15cfe1c..7d70e2753c 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -29,18 +29,19 @@ This search is to detect a suspicious un-installation of application using msiex - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-09 - **Author**: Teoderick Contreras, Splunk - **ID**: 1fca2b28-f922-11eb-b2dd-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious un-installation of application using msiex | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect a suspicious un-installation of application using msiex #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `uninstall_app_using_msiexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md index e3d8027018..412fa3d4b5 100644 --- a/docs/_posts/2021-08-10-powershell_execute_com_object.md +++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md @@ -32,17 +32,18 @@ This search is to detect a COM CLSID execution through powershell. This techniqu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 65711630-f9bf-11eb-8d72-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a COM CLSID execution through powershell. This techniqu | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_execute_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_execute_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ network operrator may use this command. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index 900ef6dad7..f4d554b272 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -26,54 +26,67 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 4e5e024e-fabb-11eb-8b8f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `fsutil_zeroing_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 92a8cec27e..6b4f16d95a 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -30,17 +30,18 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 2bcccd20-fc2b-11eb-8d22-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. | [T1218.003](https://attack.mitre.org/techniques/T1218/003/) | CMSTP | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `uac_bypass_with_colorui_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ not so common. but 3rd part app may load this dll. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index 99eee6f587..13226cb1c5 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -29,17 +29,18 @@ This search is to detect suspicious google drive or google docs files shared out - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-16 - **Author**: Teoderick Contreras, Splunk - **ID**: f6ee02d6-fea0-11eb-b2c2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search is to detect suspicious google drive or google docs files shared out | [T1567](https://attack.mitre.org/techniques/T1567/) | Exfiltration Over Web Service | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The SPL above uses the following Macros: * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_drive_share_in_external_email_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ network admin or normal user may share files to customer and external team. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index dbc65e3d61..5f10c86d78 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -29,17 +29,18 @@ This search is to detect a suspicious attachment file extension in Gsuite email - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 6d663014-fe92-11eb-ab07-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search is to detect a suspicious attachment file extension in Gsuite email | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect a suspicious attachment file extension in Gsuite email #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_email_suspicious_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ network admin and normal user may send this file attachment as part of their day #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index f7bbf3005a..d609a050de 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -30,17 +30,18 @@ This search is to detect a suspicious 7z process with commandline pointing to SM - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 01d29b48-ff6f-11eb-b81e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious 7z process with commandline pointing to SM | [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect a suspicious 7z process with commandline pointing to SM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `7zip_commandline_to_smb_share_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 74fa0b74d7..2ee0d5fd8a 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: 62721bd2-1d82-4623-b6e6-aac170014423 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -109,7 +122,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_ecr_container_scanning_findings_high_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -149,7 +162,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index 1d24f43225..0778c43a9f 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: cbc95e44-7c22-443f-88fd-0424478f5589 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -109,7 +122,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_ecr_container_scanning_findings_low_informational_unknown_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -149,7 +162,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 2a0455e937..58d17ed3e6 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: 0b80e2c8-c746-4ddb-89eb-9efd892220cf -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -109,7 +122,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_ecr_container_scanning_findings_medium_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -149,7 +162,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index d7c270a80d..821666721c 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -29,17 +29,18 @@ This search is to detect a suspicious outbound e-mail from internal email to ext - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-17 - **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk - **ID**: dc4dc3a8-ff54-11eb-8bf7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search is to detect a suspicious outbound e-mail from internal email to ext | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search is to detect a suspicious outbound e-mail from internal email to ext #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_outbound_email_with_attachment_to_external_domain_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ network admin and normal user may send this file attachment as part of their day #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 96c0d2f208..144a7cf852 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -30,17 +30,18 @@ The following analytic identifies the process - `esentutl.exe` - being used to c - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-18 - **Author**: Michael Haag, Splunk - **ID**: d372f928-ce4f-11eb-a762-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies the process - `esentutl.exe` - being used to c | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `esentutl_sam_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index d195c6d8ed..7b4df0e9af 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -29,17 +29,18 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-18 - **Author**: Michael Haag, Splunk - **ID**: d6f2b006-0041-11ec-8885-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -268,7 +281,7 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex The SPL above uses the following Macros: * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_4104_hunting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -307,7 +320,7 @@ Limited false positives. May filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index daa8866e01..7707095da2 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-19 - **Author**: Patrick Bareiss, Splunk - **ID**: d4c4d4eb-3994-41ca-a25e-a82d64e125bb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_ecr_container_upload_outside_business_hours_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -145,7 +158,7 @@ When your development is spreaded in different time zones, applying this rule ca #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 22592e7f19..94c73a8cc5 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-19 - **Author**: Patrick Bareiss, Splunk - **ID**: 300688e4-365c-4486-a065-7c884462b31d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -102,11 +115,11 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: +* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) -Note that `aws_ecr_container_upload_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * eventSource @@ -146,7 +159,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index cd20509375..17d48e69de 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -29,17 +29,18 @@ This search is to detect a gsuite email contains suspicious subject having known - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ef3971e-00f2-11ec-b54f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search is to detect a gsuite email contains suspicious subject having known | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This search is to detect a gsuite email contains suspicious subject having known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_email_suspicious_subject_with_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ normal user or normal transaction may contain the subject and file type attachme #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 09b6c2c5bc..792c4cde1e 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -26,33 +26,40 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2021-08-19 - **Author**: Rico Valdez, Splunk - **ID**: 6923cd64-17a0-453c-b945-81ac2d8c6db9 -#### Metadata +#### Annotations
ATT&CK +
+ +
Kill Chain Phase +
+ * Reconnaissance * Actions on Objectives +
NIST +
+ * PR.PT * DE.AE * PR.AC @@ -60,23 +67,29 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti +
CIS20 +
+ * CIS 9 * CIS 14 +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `protocols_passing_authentication_in_cleartext_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Some networks may use kerberized FTP or telnet servers, however, this is rare. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index ced3f7c861..acdd869b23 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -26,53 +26,66 @@ This search is to detect a pushed or commit to master or main branch. This is to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-20 - **Author**: Teoderick Contreras, Splunk - **ID**: c9d2bfe2-019f-11ec-a8eb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that `github_commit_changes_in_master_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -125,7 +138,7 @@ admin can do changes directly to master branch #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index 5316d09188..e4bff95cbe 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -26,59 +26,72 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-20 - **Author**: Patrick Bareiss, Splunk - **ID**: 0f83244b-425b-4528-83db-7a88c5f66e48 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `kubernetes_nginx_ingress_lfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_nginx_ingress_lfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -141,7 +154,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index ad50273d0b..619162a960 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 85fae8fa-0427-11ec-8b78-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getlocaluser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md index 8d1cc034c3..01a5f02d09 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 2e891cbe-0426-11ec-9c9c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getlocaluser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getlocaluser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 8b8b60bc54..371d9b9057 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: b44f6ac6-0429-11ec-87e9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getwmiobject_user_account_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 6a941e8528..bc1d07ffdc 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 640b0eda-0429-11ec-accd-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getwmiobject_user_account_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 3933b476a1..7f91afb3f4 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -29,17 +29,18 @@ This analytics is to detect a gmail containing a link that are known to be abuse - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 8630aa22-042b-11ec-af39-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This analytics is to detect a gmail containing a link that are known to be abuse | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This analytics is to detect a gmail containing a link that are known to be abuse #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_email_with_known_abuse_web_service_link_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ normal email contains this link that are known application within the organizati #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index 168768be68..0f485dcb01 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -29,17 +29,18 @@ This search is to detect a shared file in google drive with suspicious file name - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 07eed200-03f5-11ec-98fb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search is to detect a shared file in google drive with suspicious file name | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The SPL above uses the following Macros: * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gsuite_suspicious_shared_file_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ normal user or normal transaction may contain the subject and file type attachme #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index 5faf4e462a..e60f72e3ca 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -26,59 +26,72 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-23 - **Author**: Patrick Bareiss, Splunk - **ID**: fc5531ae-62fd-4de6-9c36-b4afdae8ca95 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1212](https://attack.mitre.org/techniques/T1212/) | Exploitation for Credential Access | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `kubernetes_nginx_ingress_rfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_nginx_ingress_rfi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * raw @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index 90878a48c4..26b95b6aaa 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: de7fcadc-04f3-11ec-a241-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `adsisearcher_account_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **adsisearcher_account_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index 7f9adc1c22..c45d9dd9fb 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: b1a8ce04-04c2-11ec-bea7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_account_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index 46d2266959..2a36720e6e 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 98f6a534-04c2-11ec-96b2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index 1c82f0118d..1ee95e1903 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 383572e0-04c5-11ec-bdcc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index b9f8756d77..4ff50492dd 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -26,54 +26,67 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Michael Haag, Splunk - **ID**: 4fa7f846-054a-11ec-a836-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get-domaintrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Limited false positives as this requires an active Administrator or adversary to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index 8280418137..ee1767427f 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -28,53 +28,66 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Michael Haag, Splunk - **ID**: 89275e7e-0548-11ec-bf75-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get-domaintrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ It is possible certain system management frameworks utilize this command to gath #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 55b46fa0a4..9a408350ad 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 0b6ee3f4-04e3-11ec-a87d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_aduser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index d0f3573258..f656c826b1 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 21432e40-04f4-11ec-b7e6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_aduser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_aduser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 0566aa78c2..8d25b236cb 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 9a5a41d6-04e7-11ec-923c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_domainuser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md index 2a76e16f7a..0ec7e439b6 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 61994268-04f4-11ec-865c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_domainuser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_domainuser_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 21bf40b8cc..bbc1f91c9a 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 22d3b118-04df-11ec-8fa3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getwmiobject_ds_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 8ddc69000f..fe07b877e2 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: fabd364e-04f3-11ec-b34b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getwmiobject_ds_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index 56900f4019..3fdbeb4524 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -26,59 +26,72 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-24 - **Author**: Patrick Bareiss, Splunk - **ID**: 4890cd6b-0112-4974-a272-c5c153aee551 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1526](https://attack.mitre.org/techniques/T1526/) | Cloud Service Discovery | Discovery | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `kubernetes_scanner_image_pulling_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * object.message @@ -139,7 +152,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index 5572753486..561808acbb 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `domain_group_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_group_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index 0514210cf4..4700b5ffc0 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `net.exe` with command-line arguments u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `net.exe` with command-line arguments u | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -139,7 +152,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index 31dec95f56..ed160f58cb 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: a87736a6-95cd-4728-8689-3c64d5026b3e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -139,7 +152,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index 4263248e8c..1f91ecbd22 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `elevated_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -141,7 +154,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index c276db67a0..1b075bc95a 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 10d62950-0de5-4199-a710-cff9ea79b413 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `elevated_group_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **elevated_group_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ Administrators or power users may use this PowerView for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index ed06addf91..4b3a54b22c 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `elevated_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -141,7 +154,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index 011733cead..15a5c8f89c 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 872e3063-0fc4-4e68-b2f3-f2b99184a708 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getadgroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,7 +153,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md index 41951be3bd..6926089dd7 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: e4c73d68-794b-468d-b4d0-dac1772bbae7 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getadgroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getadgroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index fe94eed2e8..f4167d61f3 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 93c94be3-bead-4a60-860f-77ca3fe59903 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getdomaingroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,7 +153,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 2554787ad7..f10e734570 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powershell.exe` with command-line util - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: e02af35c-1de5-4afe-b4be-f45aba57272b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line util #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getnettcpconnection_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 93017a47a9..40b9bcec09 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: df275a44-4527-443b-b884-7600e066e3eb -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with command-line argu | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getwmiobject_ds_group_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -140,7 +153,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index e4d5dc845b..8c3be639c5 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 67740bd3-1506-469c-b91d-effc322cc6e5 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getwmiobject_ds_group_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index eb3a805617..1e5abf7b0c 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 36e46ebe-065a-11ec-b4c7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_addefaultdomainpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index 2c6206e135..4c44107636 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 1ff7ccc8-065a-11ec-91e4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index c497ffbb80..7181ea5035 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 8b5ef342-065a-11ec-b0fc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_aduserresultantpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index 41194306b1..1c6466c013 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, MAuricio Velazco, Splunk - **ID**: 737e1eb0-065a-11ec-921a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 5043e3c1bf..59a92beff2 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: b8f9947e-065a-11ec-aafb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_domainpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index c450c2088c..00426647a8 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Splunk - **ID**: a360d2b2-065a-11ec-b0bf-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -87,10 +100,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_domainpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index b9c99d2520..7339f283ea 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-26 - **Author**: Mauricio Velazco, Splunk - **ID**: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getdomaingroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators or power users may use this PowerView functions for troubleshooti #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index f16fa19684..074ac6c176 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 09336538-065a-11ec-8665-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `password_policy_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index eda5a15b50..e2c3fb2e82 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -29,18 +29,19 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Jose Hernandez, Splunk - **ID**: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,44 +49,56 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* | [T1566.002](https://attack.mitre.org/techniques/T1566/002/) | Spearphishing Link | Initial Access | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -108,10 +121,10 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `process_creating_lnk_file_in_suspicious_location_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ This detection should yield little or no false positive results. It is uncommon #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 28e52ac2e5..4901512136 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -32,53 +32,66 @@ Review the source attempting to perform this activity against your environment. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-27 - **Author**: Michael Haag, Splunk - **ID**: 29228ab4-0762-11ec-94aa-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The SPL above uses the following Macros: * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `exchange_powershell_abuse_via_ssrf_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Limited false positives, however, tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 969bb6f8b3..bd0a1dca76 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -34,17 +34,18 @@ Module - New-managementroleassignment can assign a management role to a manageme - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-27 - **Author**: Michael Haag - **ID**: 2d10095e-05ae-11ec-8fdf-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,38 +53,50 @@ Module - New-managementroleassignment can assign a management role to a manageme | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Reconnaissance * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `exchange_powershell_module_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index e11fe42092..f2902e7957 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `nltest.exe` with command-line argument - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-30 - **Author**: Mauricio Velazco, Splunk - **ID**: 41243735-89a7-4c83-bcdd-570aa78f00a1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `nltest.exe` with command-line argument #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_controller_discovery_with_nltest_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index 0e33269243..e29a587403 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-30 - **Author**: Mauricio Velazco, Splunk - **ID**: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_system_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index d7f7266cd8..2a711dfc8a 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -30,57 +30,70 @@ During triage, review parallel security events to identify further suspicious ac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-31 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: 95b8061a-0a67-11ec-85ec-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1187](https://attack.mitre.org/techniques/T1187/) | Forced Authentication | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 | +
#### Search @@ -95,10 +108,10 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `petitpotam_network_share_access_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives have been limited when the Anonymous Logon is used for Account N #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index c82eb40735..72ea84432a 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -27,57 +27,70 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-08-31 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: e3ef244e-0a67-11ec-abf2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-36942](https://nvd.nist.gov/vuln/detail/CVE-2021-36942) | Windows LSA Spoofing Vulnerability | 5.0 | +
#### Search @@ -92,10 +105,10 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `petitpotam_suspicious_kerberos_tgt_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ False positives are possible if the environment is using certificates for authen #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index 588be08dd9..2257445617 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-08-31 - **Author**: Mauricio Velazco, Splunk - **ID**: 9fb562f4-42f8-4139-8e11-a82edf7ed718 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_system_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index b0af74589b..de512ad817 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -26,59 +26,72 @@ This search looks for disable security step in CircleCI pipeline. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `circle_ci_disable_security_step_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **circle_ci_disable_security_step_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -141,7 +154,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index 9652e7a104..08187b3666 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_controller_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index 31662b3034..ded28ae614 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: f0c9d62f-a232-4edd-b17e-bc409fb133d4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen | [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `domain_group_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -139,7 +152,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 0c46507119..1f66e9b74a 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: a9a1da02-8e27-4bf7-a348-f4389c9da487 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getadcomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index c8d574a76b..49e614d830 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 29b99201-723c-4118-847a-db2b3d3fb8ea -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getwmiobject_ds_computer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index dfe53b917a..25c3927186 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -26,53 +26,66 @@ This search is to detect a pushed or commit to develop branch. This is to avoid - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Teoderick Contreras, Splunk - **ID**: f3030cb6-0b02-11ec-8f22-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1199](https://attack.mitre.org/techniques/T1199/) | Trusted Relationship | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,7 +104,7 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that `github_commit_in_develop_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -123,7 +136,7 @@ admin can do changes directly to develop branch #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index 23a1fa4b62..9498c4e6a2 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -29,17 +29,18 @@ This search looks for Dependabot Alerts in Github logs. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 05032b04-4469-4034-9df7-05f607d75cba -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for Dependabot Alerts in Github logs. | [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that `github_dependabot_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index 1468982bb9..3d1baf9a67 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -29,17 +29,18 @@ This search looks for Pull Request from unknown user. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 9d7b9100-8878-4404-914e-ca5e551a641e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for Pull Request from unknown user. | [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -101,11 +114,11 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: -* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) -Note that `github_pull_request_from_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index a57e5b0433..a0ecf85f47 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 70803451-0047-4e12-9d63-77fa7eb8649c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `remote_system_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use Adsisearcher for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index 2f9ca247e1..c2020345d4 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: d82eced3-b1dc-42ab-859e-a2fc98827359 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_system_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index 24b56e79b2..15a7466b8c 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -26,59 +26,72 @@ This search looks for disable security job in CircleCI pipeline. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-02 - **Author**: Patrick Bareiss, Splunk - **ID**: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1554](https://attack.mitre.org/techniques/T1554/) | Compromise Client Software Binary | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `circle_ci_disable_security_job_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **circle_ci_disable_security_job_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index 8e2574c1d9..77392f5e2f 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -26,54 +26,67 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-02 - **Author**: Michael Haag, Splunk - **ID**: 584f4884-0bf1-11ec-a5ec-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get-foresttrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Limited false positives as this requires an active Administrator or adversary to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index c4fcc39cd2..28f3510082 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -28,53 +28,66 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-02 - **Author**: Michael Haag, Splunk - **ID**: 70fac80e-0bf1-11ec-9ba0-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get-foresttrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ UPDATE_KNOWN_FALSE_POSITIVES #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index 6606ecbf84..3544d08a5a 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-02 - **Author**: Mauricio Velazco, Splunk - **ID**: f64da023-b988-4775-8d57-38e512beb56e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getdomaincomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use PowerView for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 3cb7a6d184..d9c44e8e26 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-02 - **Author**: Mauricio Velazco, Splunk - **ID**: 676b600a-a94d-4951-b346-11329431e6c1 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getdomaincontroller_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index e497b73a1e..f95cb82a9b 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -26,54 +26,67 @@ This search is to detect a suspicious bcdedit commandline to configure the host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-06 - **Author**: Teoderick Contreras, Splunk - **ID**: dc7a8004-0f18-11ec-8c54-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `bcdedit_command_back_to_normal_mode_boot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index 88c03359f0..9e88e01d9d 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -26,54 +26,67 @@ This search is to detect a suspicious bcdedit commandline to configure the host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 81f1dce0-0f18-11ec-a5d7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a suspicious bcdedit commandline to configure the host #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `change_to_safe_mode_with_network_config_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index 1315f07a80..1686072b64 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -29,17 +29,18 @@ This search correlations detections by repository and risk_score - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search correlations detections by repository and risk_score | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search correlations detections by repository and risk_score The SPL above uses the following Macros: * [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml) -Note that `correlation_by_repository_and_risk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **correlation_by_repository_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index 1e5ddd46ee..3909edb3f4 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -29,17 +29,18 @@ This search correlations detections by user and risk_score - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search correlations detections by user and risk_score | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search correlations detections by user and risk_score The SPL above uses the following Macros: * [signals](https://github.com/splunk/security_content/blob/develop/macros/signals.yml) -Note that `correlation_by_user_and_risk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **correlation_by_user_and_risk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index d6c0073621..af3985fa64 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: c5a31f80-5888-4d81-9f78-1cc65026316e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getadcomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 64d315cbb2..652c2bbf63 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: ed550c19-712e-43f6-bd19-6f58f61b3a5e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getdomaincomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use PowerView for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index 974d1b781c..70c9b0df61 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 868ee0e4-52ab-484a-833a-6d85b7c028d0 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getdomaincontroller_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -135,7 +148,7 @@ Administrators or power users may use PowerView for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index b1f2b9f8e8..1db32dc7a8 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getwmiobject_ds_computer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 2fdf667bb8..b0576cbb0c 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -30,17 +30,18 @@ This analytic is to detect an application try to connect and create ADSI Object - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-07 - **Author**: Teoderick Contreras, Splunk - **ID**: 991eb510-0fc6-11ec-82d3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect an application try to connect and create ADSI Object | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This analytic is to detect an application try to connect and create ADSI Object #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schcache_change_by_app_connect_and_create_adsi_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ normal application like mmc.exe and other ldap query tool may trigger this detec #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 6e1a36348d..a2c924e506 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -26,59 +26,72 @@ Detect system information discovery techniques used by attackers to understand c - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Patrick Bareiss, Splunk - **ID**: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 6 * CIS 8 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ Detect system information discovery techniques used by attackers to understand c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `system_information_discovery_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Administrators debugging servers #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index fe6e4b8633..3578087dc0 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -30,18 +30,19 @@ The following detection identifies control.exe loading either a .cpl or .inf fro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 10423ac4-10c9-11ec-8dc4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following detection identifies control.exe loading either a .cpl or .inf fro | [T1218.002](https://attack.mitre.org/techniques/T1218/002/) | Control Panel | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -99,10 +112,10 @@ The following detection identifies control.exe loading either a .cpl or .inf fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `control_loading_from_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -149,7 +162,7 @@ Limited false positives will be present as control.exe does not natively load fr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 6912774f20..89b17543f7 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -29,18 +29,19 @@ This search looks for the creation of local administrator accounts using net.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Bhavin Patel, Splunk - **ID**: b89919ed-fe5f-492c-b139-151bb162040e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for the creation of local administrator accounts using net.exe | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This search looks for the creation of local administrator accounts using net.exe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `create_local_admin_accounts_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Administrators often leverage net.exe to create admin accounts. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index f3bf8f3357..551671112f 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -30,18 +30,19 @@ The following detection identifies control.exe spawning from an office product. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 053e027c-10c7-11ec-8437-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following detection identifies control.exe spawning from an office product. | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -99,10 +112,10 @@ The following detection identifies control.exe spawning from an office product. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_spawning_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -150,7 +163,7 @@ Limited false positives should be present. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index 596c1d4c1f..0586fc46a3 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -31,17 +31,18 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: c8e7ced0-10c5-11ec-8b03-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -100,10 +113,10 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_control_rundll_hunt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -152,7 +165,7 @@ This is a hunting detection, meant to provide a understanding of how voluminous #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 8b5ced8bef..90e713da54 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -30,18 +30,19 @@ The following detection identifies rundll32.exe with `control_rundll` within the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 1adffe86-10c3-11ec-8ce6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following detection identifies rundll32.exe with `control_rundll` within the | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -100,10 +113,10 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_control_rundll_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -152,7 +165,7 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index 2c4d69fa70..06c0639f90 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -29,18 +29,19 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-09 - **Author**: Michael Haag, Splunk - **ID**: 8bbb7d58-b360-11eb-ba21-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `extraction_of_registry_hives_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ It is possible some agent based products will generate false positives. Filter a #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 4b56dfcc17..6fe995e38e 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -31,17 +31,18 @@ The following detection identifies the module load of mshtml.dll into an Office - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-09 - **Author**: Michael Haag, Splunk - **ID**: 5f1c168e-118b-11ec-84ff-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following detection identifies the module load of mshtml.dll into an Office | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -99,10 +112,10 @@ The following detection identifies the module load of mshtml.dll into an Office #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `mshtml_module_load_in_office_product_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Limited false positives will be present, however, tune as necessary. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 94e89e5325..c17b914d02 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 091712ff-b02a-4d43-82ed-34765515d95d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getnettcpconnection_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index b662f7aa88..15e62a9286 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: ae008c0f-83bd-4ed4-9350-98d4328e15d2 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `network_connection_discovery_with_arp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index 74d44bf09b..2dcd1588cd 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `net.exe` with command-line arguments u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `net.exe` with command-line arguments u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `network_connection_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index 70903a401a..137f00e536 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 2cf5cc25-f39a-436d-a790-4857e5995ede -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `network_connection_discovery_with_netstat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * Processes.dest @@ -134,7 +147,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index d9b68ffc29..2aa8e80891 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -31,17 +31,18 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-10 - **Author**: Michael Haag, Splunk - **ID**: f48cd1d4-125a-11ec-a447-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 | +
#### Search @@ -105,7 +118,7 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `office_product_writing_cab_or_inf_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index a9b029d3c7..e138e64cf9 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 7eb9c3d5-c98c-4088-acc5-8240bad15379 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `getcurrent_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md index 4ec74ecce6..91fb69a4bb 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 80879283-c30f-44f7-8471-d1381f6d437a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `getcurrent_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **getcurrent_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index b1a9fbd59b..3b7b2966f0 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -29,18 +29,19 @@ This search is to detect a execution of jscript using cscript process. Commonly - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 002f1e24-146e-11ec-a470-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a execution of jscript using cscript process. Commonly | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect a execution of jscript using cscript process. Commonly #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `jscript_execution_using_cscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index a0ae39a0a9..d466c29b33 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -30,17 +30,18 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 0b0c40dc-14a6-11ec-b267-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ms_scripting_process_loading_ldap_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ automation scripting language may used by network operator to do ldap query. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 493c083ae8..25a5d34c04 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -30,17 +30,18 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 2eba3d36-14a6-11ec-a682-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ms_scripting_process_loading_wmi_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ automation scripting language may used by network operator to do ldap query. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index b1cdbf2d9a..0be5e7f52a 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -30,17 +30,18 @@ This search is to detect a suspicious MS office application that drop or create - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Michael Haag Splunk - **ID**: 73ce70c4-146d-11ec-9184-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious MS office application that drop or create | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This search is to detect a suspicious MS office application that drop or create The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `office_application_drop_executable_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_application_drop_executable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ office macro for automation may do this behavior #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 32bb5f5011..2ad7dbf583 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `query.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: ad03bfcf-8a91-4bc2-a500-112993deba87 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `query.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `system_user_discovery_with_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 0d37397153..00563ff01e 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `system_user_discovery_with_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index 866d172b44..b2b7f846f6 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -27,53 +27,66 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 0cdf318b-a0dd-47d7-b257-c621c0247de8 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This analytic looks for the execution of `powershell.exe` with command-line argu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `user_discovery_with_env_vars_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md index cec6cc0ea2..06f3e8204d 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `user_discovery_with_env_vars_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **user_discovery_with_env_vars_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -127,7 +140,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index c076498b07..a3f25d5dae 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -26,54 +26,67 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 004e32e2-146d-11ec-a83f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `xsl_script_execution_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index e75fd7a07d..4bf3e11d30 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -29,18 +29,19 @@ The following analytic identifies a non-standard parent process (not matching CM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-14 - **Author**: Teoderick Contreras, Splunk - **ID**: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies a non-standard parent process (not matching CM | [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analytic identifies a non-standard parent process (not matching CM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cmdline_tool_not_executed_in_cmd_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ A network operator or systems administrator may utilize an automated host discov #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 8411807165..6195a6221a 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -30,17 +30,18 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 5434f670-155d-11ec-8cca-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `get_wmiobject_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ False positives may be present. Tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md index b4febbee87..7a4ee3550b 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md @@ -31,17 +31,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 69df7f7c-155d-11ec-a055-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `get_wmiobject_group_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **get_wmiobject_group_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives may be present. Tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index 99d433ce20..c227813936 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -30,17 +30,18 @@ The following hunting analytic will identify the use of localgroup discovery usi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 54f5201e-155b-11ec-a6e2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following hunting analytic will identify the use of localgroup discovery usi | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following hunting analytic will identify the use of localgroup discovery usi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `net_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ False positives may be present. Tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index a6997bc294..9a1ea5802b 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -30,17 +30,18 @@ The following hunting analytic identifies the use of `get-localgroup` being used - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: b71adfcc-155b-11ec-9413-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following hunting analytic identifies the use of `get-localgroup` being used | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following hunting analytic identifies the use of `get-localgroup` being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `powershell_get_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ False positives may be present. Tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index 000fc62b81..a7d5560642 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -31,17 +31,18 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: d7c6ad22-155c-11ec-bb64-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ During triage, review parallel processes using an EDR product or 4688 events. It | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_get_localgroup_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives may be present. Tune as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 1ebbfa8ebf..899fc48279 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -32,17 +32,18 @@ During triage, review parallel processes and identify any further suspicious beh - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 83317b08-155b-11ec-8e00-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ During triage, review parallel processes and identify any further suspicious beh | [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ During triage, review parallel processes and identify any further suspicious beh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wmic_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 1adf7170ad..cfede24e2d 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -26,54 +26,67 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: a9079b18-1633-11ec-859c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1033](https://attack.mitre.org/techniques/T1033/) | System Owner/User Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `check_elevated_cmd_using_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 43ad1c80d0..7faccae078 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -30,17 +30,18 @@ This search is to detect an anomaly event of non-chrome process accessing the fi - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: 81263de4-160a-11ec-944f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect an anomaly event of non-chrome process accessing the fi | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `non_chrome_process_accessing_chrome_default_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ other browser not listed related to firefox may catch by this rule. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index 5f34b57f83..bc541ca2ed 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -30,17 +30,18 @@ This search is to detect an anomaly event of non-firefox process accessing the f - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: e6fc13b0-1609-11ec-b533-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect an anomaly event of non-firefox process accessing the f | [T1555.003](https://attack.mitre.org/techniques/T1555/003/) | Credentials from Web Browsers | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `non_firefox_process_access_firefox_profile_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ other browser not listed related to firefox may catch by this rule. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 4baae3d629..64ae29ee01 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -29,18 +29,19 @@ this search is to detect a potential account discovery series of command used by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 339805ce-ac30-11eb-b87d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to detect a potential account discovery series of command used by | [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ admin or power user may used this series of command. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 2c650ef0da..629b9c13e1 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -29,18 +29,19 @@ Attempt To Add Certificate To Untrusted Store - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Rico Valdez, Splunk - **ID**: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,46 +49,58 @@ Attempt To Add Certificate To Untrusted Store | [T1553](https://attack.mitre.org/techniques/T1553/) | Subvert Trust Controls | Defense Evasion | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 8 +
CVE +
+
#### Search @@ -103,11 +116,11 @@ Attempt To Add Certificate To Untrusted Store #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -Note that `attempt_to_add_certificate_to_untrusted_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ There may be legitimate reasons for administrators to add a certificate to the u #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index e3aaf35bae..2408b97d89 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -29,18 +29,19 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,12 +113,12 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index db106eee03..9f525a1942 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -29,18 +29,19 @@ The search looks for a batch file (.bat) written to the Windows system directory - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Rico Valdez, Splunk - **ID**: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The search looks for a batch file (.bat) written to the Windows system directory | [T1204.002](https://attack.mitre.org/techniques/T1204/002/) | Malicious File | Execution | +
Kill Chain Phase +
+ * Delivery +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ The search looks for a batch file (.bat) written to the Windows system directory The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `batch_file_write_to_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **batch_file_write_to_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ It is possible for this search to generate a notable event for a batch file writ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index ebbc589fbc..2d4fdb42fb 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -27,54 +27,67 @@ The following query identifies Microsoft Background Intelligent Transfer Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: e97a5ffe-90bf-11eb-928a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1197](https://attack.mitre.org/techniques/T1197/) | BITS Jobs | Defense Evasion, Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,11 +103,11 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `bits_job_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Limited false positives will be present. Typically, applications will use `BitsA #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index b48b5fe3ec..23db7765d2 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -30,18 +30,19 @@ The following query identifies Microsoft Background Intelligent Transfer Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 80630ff4-8e4c-11eb-aab5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ The following query identifies Microsoft Background Intelligent Transfer Service | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,11 +108,11 @@ The following query identifies Microsoft Background Intelligent Transfer Service #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `bitsadmin_download_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Limited false positives, however it may be required to filter based on parent pr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index 57fbf3517a..42e3ea1327 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -29,18 +29,19 @@ This search detects the use of wmic and Powershell to create a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: 2ed8b538-d284-449a-be1d-82ad1dbd186b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search detects the use of wmic and Powershell to create a shadow copy. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -99,12 +112,12 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `creation_of_shadow_copy_with_wmic_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Legtimate administrator usage of wmic to create a shadow copy. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index 94e94f684c..365c519944 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -29,18 +29,19 @@ This search detects credential dumping using copy command from a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: d8c406fe-23d2-45f3-a983-1abe7b83ff3b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search detects credential dumping using copy command from a shadow copy. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `credential_dumping_via_copy_command_from_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index 27db62a1ad..4c0728f1c0 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -29,18 +29,19 @@ This search detects the creation of a symlink to a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: c5eac648-fae0-4263-91a6-773df1f4c903 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search detects the creation of a symlink to a shadow copy. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `credential_dumping_via_symlink_to_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md index 59a409121d..0d965cc633 100644 --- a/docs/_posts/2021-09-16-detect_html_help_renamed.md +++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md @@ -30,17 +30,18 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 62fed254-513b-460e-953d-79771493a9f3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_html_help_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 97d91e7805..cb751b0141 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -29,18 +29,19 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 8c5835b9-39d9-438b-817c-95f14c69a31e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_html_help_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index 7eb8ce9f77..194ae749ba 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -29,18 +29,19 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 0b2eefa5-5508-450d-b970-3dd2fb761aec -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM | [T1218.001](https://attack.mitre.org/techniques/T1218/001/) | Compiled HTML File | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -99,11 +112,11 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_html_help_using_infotech_storage_handlers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index ec156fb9e7..ab5f8de9e7 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -29,18 +29,19 @@ The following analytic identifies "mshta.exe" execution with inline protocol han - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Bhavin Patel, Michael Haag, Splunk - **ID**: a0873b32-5b68-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies "mshta.exe" execution with inline protocol han | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that `detect_mshta_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md index 63317a932c..4b0259d278 100644 --- a/docs/_posts/2021-09-16-detect_mshta_renamed.md +++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md @@ -30,17 +30,18 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 8f45fcf0-5b68-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that `detect_mshta_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 93bf636258..89651dc8d9 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -29,18 +29,19 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit | [T1218.005](https://attack.mitre.org/techniques/T1218/005/) | Mshta | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) -Note that `detect_mshta_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ It is possible legitimate applications may perform this behavior and will need t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index d7d956348a..2351ec5cab 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -29,18 +29,19 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Bhavin Patel, Splunk - **ID**: 27c3a83d-cada-47c6-9042-67baf19d2574 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) -Note that `detect_psexec_with_accepteula_flag_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrators can leverage PsExec for accessing remote systems and might pass ` #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index 708fbef7af..cdd806c7cf 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -30,17 +30,18 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 4057291a-b8cf-11eb-95fe-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag | [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_renamed_7-zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Limited false positives, however this analytic will need to be modified for each #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md index 6358cb13cd..8f357ac15a 100644 --- a/docs/_posts/2021-09-16-detect_renamed_psexec.md +++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md @@ -30,17 +30,18 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 683e6196-b8e8-11eb-9a79-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml) -Note that `detect_renamed_psexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Limited false positives should be present. It is possible some third party appli #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index 250021d385..08d288f6b1 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -26,53 +26,66 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 6dca1124-b3ec-11eb-9328-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_renamed_rclone_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ False positives should be limited as this analytic identifies renamed instances #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index 135290092a..b7382fef74 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -30,17 +30,18 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas | [T1560](https://attack.mitre.org/techniques/T1560/) | Archive Collected Data | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_renamed_winrar_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Unknown. It is possible third party applications use renamed instances of WinRAR #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 6bc5e75b6f..d264a0a768 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -30,18 +30,19 @@ During triage, confirm this is procdump.exe executing. If it is the first time a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 3742ebfe-64c2-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,43 +50,55 @@ During triage, confirm this is procdump.exe executing. If it is the first time a | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ During triage, confirm this is procdump.exe executing. If it is the first time a #### Macros The SPL above uses the following Macros: * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dump_lsass_via_procdump_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index 9bf39464bd..e7a843e35e 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 5d0d4830-0133-11ec-bae3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `local_account_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 2a27383c92..e54711cdfa 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -30,17 +30,18 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 4902d7aa-0134-11ec-9d65-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `local_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Administrators or power users may use this command for troubleshooting. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index e6f56af8d8..f494214095 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -29,18 +29,19 @@ The following detection identifies the latest behavior utilized by Ursnif malwar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: ffc236d6-a6c9-11eb-95f1-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following detection identifies the latest behavior utilized by Ursnif malwar | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ The following detection identifies the latest behavior utilized by Ursnif malwar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_product_spawning_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ No false positives known. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index 1c9dc5e9f4..f1098a5fe4 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -29,18 +29,19 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Josef Kuepker, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162040e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr #### Macros The SPL above uses the following Macros: * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `processes_launching_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index 8c0bfaa060..2101d93e7b 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -29,18 +29,19 @@ This search is to detect potential malicious office document executing lolbin ch - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect potential malicious office document executing lolbin ch | [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search is to detect potential malicious office document executing lolbin ch #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `office_document_spawned_child_process_to_download_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Default browser not in the filter list. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md index 8e25c89a0d..d00fa64fff 100644 --- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md @@ -33,17 +33,18 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-20 - **Author**: Michael Haag, Splunk - **ID**: f0db4464-55d9-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,42 +54,54 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -104,11 +117,11 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_microsoft_workflow_compiler_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -155,7 +168,7 @@ Although unlikely, some legitimate applications may use a moved copy of microsof #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index a0dfef114c..c2bdeb5212 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -27,53 +27,66 @@ This search is to detect file creation in remcos folder in appdata which is the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 25ae862a-1ac3-11ec-94a1-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search is to detect file creation in remcos folder in appdata which is the #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remcos_rat_file_creation_in_remcos_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index f9b177ce91..809181e1fe 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -27,53 +27,66 @@ This search is to detect a suspicious creation of image in appdata folder made b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: f6f904c4-1ac0-11ec-806b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This search is to detect a suspicious creation of image in appdata folder made b The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `suspicious_image_creation_in_appdata_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index 5186d9b728..18f133b3ce 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -27,53 +27,66 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 5be109e6-1ac5-11ec-b421-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `suspicious_wav_file_in_appdata_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index d7a24dd038..a4b700a3be 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -31,18 +31,19 @@ This analytic is developed to detect suspicious registry modification to change - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 462d17d8-1f71-11ec-ad07-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic is developed to detect suspicious registry modification to change | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This analytic is developed to detect suspicious registry modification to change #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `change_default_file_association_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index 64b4def59a..531281d931 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -31,18 +31,19 @@ This search is to detect a suspicious modification of registry entry to persist - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 4c38c264-1f74-11ec-b5fa-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a suspicious modification of registry entry to persist | [T1037.001](https://attack.mitre.org/techniques/T1037/001/) | Logon Script (Windows) | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This search is to detect a suspicious modification of registry entry to persist #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `logon_script_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index 9887f73601..3dd82fd3dd 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -31,18 +31,19 @@ This analytic is developed to detect possible event trigger execution through sc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 58cea3ec-1f6d-11ec-8560-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic is developed to detect possible event trigger execution through sc | [T1546.002](https://attack.mitre.org/techniques/T1546/002/) | Screensaver | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This analytic is developed to detect possible event trigger execution through sc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `screensaver_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 0cae3ac341..038eaba732 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -34,17 +34,18 @@ This analytic is to detect a suspicious modification or new registry entry regar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 1f5b68aa-2037-11ec-898e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ This analytic is to detect a suspicious modification or new registry entry regar | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This analytic is to detect a suspicious modification or new registry entry regar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `print_processor_registry_autostart_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ possible new printer installation may add driver component on this registry. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 510ff6f2dc..90ebfbe0e2 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -30,17 +30,18 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-09-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 61e9a56a-20fa-11ec-8ba3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil #### Macros The SPL above uses the following Macros: -* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml) -Note that `verclsid_clsid_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ windows can used this application for its normal COM object validation. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index 1f1013453e..7c3c0c36bf 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-01 - **Author**: Teoderick Contreras, Splunk - **ID**: 35159940-228f-11ec-8a49-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `vbscript_execution_using_wscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 3ad9c80cef..60e40a314f 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 213b3148-24ea-11ec-93a2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind | [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `msbuild_suspicious_spawned_by_script_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ False positives should be limited as developers do not spawn MSBuild via a WSH. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 0ae6ff90f7..471eed343e 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -29,18 +29,19 @@ This analytic is to detect a loading of dll using regsvr32 application with sile - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-04 - **Author**: Teoderick Contreras, Splunk - **ID**: f421c250-24e7-11ec-bc43-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a loading of dll using regsvr32 application with sile | [T1218.010](https://attack.mitre.org/techniques/T1218/010/) | Regsvr32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This analytic is to detect a loading of dll using regsvr32 application with sile #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -Note that `regsvr32_silent_and_install_param_dll_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Other third part application may used this parameter but not so common in base w #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md index 5148b4bef0..a0bb42b16f 100644 --- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -32,18 +32,19 @@ The following query identifies suspicious .aspx created in 3 paths identified by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Shannon Davis, David Dorsey, Splunk - **ID**: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,37 +54,49 @@ The following query identifies suspicious .aspx created in 3 paths identified by | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -105,7 +118,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_exchange_web_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_exchange_web_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index 9eea76ada1..5d213c80d5 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -30,17 +30,18 @@ The following analytic identifies a process modifying the registry with a known - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: 127c8d08-25ff-11ec-9223-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies a process modifying the registry with a known | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies a process modifying the registry with a known #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `malicious_inprocserver32_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited, filter as needed. In our test case, Remcos us #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index 976ee7305b..a466d1f6bb 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -30,17 +30,18 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: b0a078e4-2601-11ec-9aec-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win | [T1559.001](https://attack.mitre.org/techniques/T1559/001/) | Component Object Model | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,10 +112,10 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `process_writing_dynamicwrapperx_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ False positives should be limited, however it is possible to filter by Processes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index 15f2db1e0b..0a449794a3 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -26,54 +26,67 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Teoderick Contreras, Splunk - **ID**: a913718a-25b6-11ec-96d3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_shimcache_flush_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index 62a2f49b44..d29ff00567 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Teoderick Contreras, Splunk - **ID**: ce633e56-25b2-11ec-9e76-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t | [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_copy_on_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ every user may do this event but very un-ussual. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 0250497d39..ba25a484ff 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -27,54 +27,67 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: d17dae9e-2618-11ec-b9f5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winhlp32_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives should be limited as winhlp32.exe is typically not used with the #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md index c520152ed1..2c694027ef 100644 --- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -29,18 +29,19 @@ This search allows you to identify DNS requests and compute the standard deviati - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Bhavin Patel, Splunk - **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,44 +49,56 @@ This search allows you to identify DNS requests and compute the standard deviati | [T1048](https://attack.mitre.org/techniques/T1048/) | Exfiltration Over Alternative Protocol | Exfiltration | +
Kill Chain Phase +
+ * Command & Control +
NIST +
+ * PR.PT * DE.AE * DE.CM +
CIS20 +
+ * CIS 8 * CIS 12 +
CVE +
+
#### Search @@ -110,7 +123,7 @@ This search allows you to identify DNS requests and compute the standard deviati The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `dns_query_length_with_high_standard_deviation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dns_query_length_with_high_standard_deviation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ It's possible there can be long domain names that are legitimate. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 0c5aa6460f..b583f29876 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -32,18 +32,19 @@ This analytic is to detect the execution of sdelete.exe application sysinternal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 31702fc0-2682-11ec-85c3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,37 +54,49 @@ This analytic is to detect the execution of sdelete.exe application sysinternal | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,11 +112,11 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `sdelete_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ user may execute and use this application #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index 9c33561080..ba70937134 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -39,18 +39,19 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 1f35e1da-267b-11ec-90a9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -62,37 +63,49 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc | [T1134](https://attack.mitre.org/techniques/T1134/) | Access Token Manipulation | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -108,10 +121,10 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wscript_or_cscript_suspicious_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -158,7 +171,7 @@ Administrators may create vbs or js script that use several tool as part of its #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index b683340cc8..caf2f1a03f 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -29,18 +29,19 @@ The wevtutil.exe application is the windows event log utility. This searches for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-11 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,21 +49,27 @@ The wevtutil.exe application is the windows event log utility. This searches for | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.DP * PR.IP * PR.PT @@ -72,24 +79,30 @@ The wevtutil.exe application is the windows event log utility. This searches for +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 6 +
CVE +
+
#### Search @@ -105,10 +118,10 @@ The wevtutil.exe application is the windows event log utility. This searches for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_wevtutil_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ The wevtutil.exe application is a legitimate Windows event log utility. Administ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index 66c933dc8f..fc944b6613 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -30,53 +30,66 @@ During triage, review parallel processes for further suspicious activity. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-10-14 - **Author**: Michael Haag, Splunk - **ID**: 13243068-2d38-11ec-8908-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `serviceprincipalnames_discovery_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -151,7 +164,7 @@ False positives should be limited, however filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index e901f009d8..0218ee8f45 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -33,54 +33,67 @@ During triage, review parallel processes for further suspicious activity. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-14 - **Author**: Michael Haag, Splunk - **ID**: ae8b3efc-2d2e-11ec-8b57-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `serviceprincipalnames_discovery_with_setspn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -152,7 +165,7 @@ False positives may be caused by Administrators resetting SPNs or querying for S #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index dd8a3cdb67..2943b0a04b 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious commandline to disable existing schedule - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-18 - **Author**: Teoderick Contreras, Splunk - **ID**: db596056-3019-11ec-a9ff-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious commandline to disable existing schedule | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic is to detect a suspicious commandline to disable existing schedule #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `disable_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ admin may disable problematic schedule task #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index 28b0834f8d..54892ffba6 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -28,54 +28,67 @@ During triage, review parallel processes for further behavior. In addition, iden - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-19 - **Author**: Michael Haag, Splunk - **ID**: c32f091e-30db-11ec-8738-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ During triage, review parallel processes for further behavior. In addition, iden #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_curl_download_to_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ It is possible Administrators or super users will use Curl for legitimate purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 578171cdfe..5af6decbb8 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -29,53 +29,66 @@ The following hunting analytic assists with identifying suspicious tasks that ha - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-10-19 - **Author**: Michael Haag, Splunk - **ID**: b3632472-310b-11ec-9aab-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `winevent_windows_task_scheduler_event_action_started_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ False positives will be present. Filter based on ActionName paths or specify key #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index 08efee5bfb..19d164fe8a 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -30,17 +30,18 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-10-20 - **Author**: Teoderick Contreras, Splunk - **ID**: bff0e7a0-317f-11ec-ab4e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wmic_noninteractive_app_uninstallation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ third party application may use this approach to uninstall there application #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index 2756b4981b..b866a2bf67 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -28,53 +28,66 @@ This search can help the detection of compromised accounts or internal users sha - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-10-24 - **Author**: Rod Soto, Teoderick Contreras - **ID**: a7131dae-34e3-11ec-a2de-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ This search can help the detection of compromised accounts or internal users sha The SPL above uses the following Macros: * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml) -Note that `gdrive_suspicious_file_sharing_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gdrive_suspicious_file_sharing_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ This is an anomaly search, you must specify your domain in the parameters so it #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index b542355fe4..7f9cbaa0e5 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -28,53 +28,66 @@ This search can help the detection of compromised accounts or internal users sen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-10-24 - **Author**: Rod Soto, Teoderick Contreras - **ID**: 03cdd68a-34fb-11ec-9bd3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This search can help the detection of compromised accounts or internal users sen The SPL above uses the following Macros: * [gsuite_calendar](https://github.com/splunk/security_content/blob/develop/macros/gsuite_calendar.yml) -Note that `gsuite_suspicious_calendar_invite_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gsuite_suspicious_calendar_invite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ This search will also produce normal activity statistics. Fields such as email, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index 7fa55d4c45..2d33a7e038 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -26,59 +26,72 @@ This search looks for the execution of `adfind.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-03 - **Author**: Jose Hernandez, Bhavin Patel, Splunk - **ID**: bd3b0187-189b-46c0-be45-f52da2bae67f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This search looks for the execution of `adfind.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_adfind_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ administrators rarely use adfind, usually not used for legitimate reasons #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index bd4ea9d6fb..66f2db97da 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -35,18 +35,19 @@ This search looks for execution of commonly used attacker tools on an endpoint. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-04 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-48cc-b4e4-16a110145893 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,44 +59,56 @@ This search looks for execution of commonly used attacker tools on an endpoint. | [T1595](https://attack.mitre.org/techniques/T1595/) | Active Scanning | Reconnaissance | +
Kill Chain Phase +
+ * Installation * Command & Control * Actions on Objectives +
NIST +
+ * ID.AM * PR.DS +
CIS20 +
+ * CIS 2 +
CVE +
+
#### Search @@ -113,10 +126,10 @@ This search looks for execution of commonly used attacker tools on an endpoint. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `attacker_tools_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Lookups The SPL above uses the following Lookups: @@ -156,7 +169,7 @@ Some administrator activity can be potentially triggered, please add those users #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 14a7a824d1..66e1b03764 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -30,54 +30,67 @@ Adversaries may use one of the three methods based on the remote destination and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Michael Haag, Splunk - **ID**: 42f8f1a2-4228-11ec-aade-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ Adversaries may use one of the three methods based on the remote destination and #### Macros The SPL above uses the following Macros: * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_curl_upload_to_remote_destination_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ False positives may be limited to source control applications and may be require #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index 60d987b933..2ce2d86564 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -31,18 +31,19 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Mauricio Velazco, Splunk - **ID**: e0eea4fa-4274-11ec-882b-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_service_creation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrators may create Windows Services on remote systems, but this activity #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index 4500045e92..d50220cb14 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -31,18 +31,19 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 3f519894-4276-11ec-ab02-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_service_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Administrators may start Windows Services on remote systems, but this activity i #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index 779e2dde33..7c2b9a8602 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 0dd296a2-4338-11ec-ba02-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_process_instantiation_via_winrm_and_winrs_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Administrators may leverage WinRM and WinRs to start a process on remote systems #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index 2e038743be..f13678a0ac 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -33,18 +33,19 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 4be54858-432f-11ec-8209-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut | [T1053.002](https://attack.mitre.org/techniques/T1053/002/) | At (Windows) | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `scheduled_task_creation_on_remote_endpoint_using_at_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 3308f132bb..1d9253db6d 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -33,18 +33,19 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 95cf4608-4302-11ec-8194-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `scheduled_task_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrators may start scheduled tasks on remote systems, but this activity is #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md index 7f4e49691e..1cfa95eeef 100644 --- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md @@ -33,18 +33,19 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: David Dorsey, Mauricio Velazco, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,41 +53,53 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `schtasks_scheduling_job_on_remote_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index e68ffe6474..9348248b8a 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -26,54 +26,67 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Michael Haag, Splunk - **ID**: 787e9dd0-4328-11ec-a029-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1220](https://attack.mitre.org/techniques/T1220/) | XSL Script Processing | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wmic_xsl_execution_via_url_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives are limited as legitimate applications typically do not download #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index 8d53f21d02..14aa94136a 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -26,53 +26,66 @@ The following detection identifies excessive AccessDenied events within an hour - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: 3e1f1568-9633-11eb-a69c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1580](https://attack.mitre.org/techniques/T1580/) | Cloud Infrastructure Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_iam_accessdenied_discovery_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ It is possible to start this detection will need to be tuned by source IP or use #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index f1de9fa65f..3efe4e5ef7 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -30,17 +30,18 @@ this analytic is to detect a suspicious compile before delivery approach of .net - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: ea73128a-43ab-11ec-9753-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this analytic is to detect a suspicious compile before delivery approach of .net | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ this analytic is to detect a suspicious compile before delivery approach of .net #### Macros The SPL above uses the following Macros: * [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `csc_net_on_the_fly_compilation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ A network operator or systems administrator may utilize an automated powershell #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index c009c05c28..4b5f89536f 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -29,18 +29,19 @@ This analytic detects a potential suspicious modification of firewall rule allow - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 9a8f63a8-43ac-11ec-904c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a potential suspicious modification of firewall rule allow | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic detects a potential suspicious modification of firewall rule allow #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `firewall_allowed_program_enable_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ A network operator or systems administrator may utilize an automated or manual e #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 680b94c480..7eecaf5da4 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -30,17 +30,18 @@ This analytic look for a spawned process of route.exe windows application. Adver - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: dd83407e-439f-11ec-ab8e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic look for a spawned process of route.exe windows application. Adver | [T1016.001](https://attack.mitre.org/techniques/T1016/001/) | Internet Connection Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic look for a spawned process of route.exe windows application. Adver #### Macros The SPL above uses the following Macros: * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `network_discovery_using_route_windows_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ A network operator or systems administrator may utilize an automated host discov #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 1f79285f06..9b12b47e4b 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -26,38 +26,45 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Rico Valdez, Mauricio Velazco, Splunk - **ID**: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * PR.AT * PR.AC @@ -65,23 +72,29 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc +
CIS20 +
+ * CIS 3 * CIS 5 +
CVE +
+
#### Search @@ -97,11 +110,11 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_process_instantiation_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ The wmic.exe utility is a benign Windows application. It may be used legitimatel #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index ec520d3852..9948cd3943 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -32,17 +32,18 @@ This analytic look for a spawned runas.exe process with a administrator user opt - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 4807e716-43a4-11ec-a0e7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic look for a spawned runas.exe process with a administrator user opt | [T1134.001](https://attack.mitre.org/techniques/T1134/001/) | Token Impersonation/Theft | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,11 +109,11 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) -Note that `runas_execution_in_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ A network operator or systems administrator may utilize an automated or manual e #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md index 2720a41e0e..4d11b99aa7 100644 --- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md +++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md @@ -32,18 +32,19 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: ccfeddec-43ec-11ec-b494-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,37 +52,49 @@ During triage review resulting network connections, file modifications, and para | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_credential_theft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Typically this will not trigger as by it's very nature InstallUtil does not need #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index b2f01cd12e..0cd3b1d6ff 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -33,18 +33,19 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: cfa7b9ac-43f0-11ec-9b48-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ During triage review resulting network connections, file modifications, and para | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,11 +111,11 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_uninstall_option_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Limited false positives should be present. Filter as needed by parent process or #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index 0196c9ec9b..45defa4f5e 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -32,18 +32,19 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: 28e06670-43df-11ec-a569-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,37 +52,49 @@ During triage review resulting network connections, file modifications, and para | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,11 +110,11 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Limited false positives should be present as InstallUtil is not typically used t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 72968f2158..4cfabd7fc8 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: d4f42098-4680-11ec-ad07-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize | [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_process_instantiation_via_dcom_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 9c5d52c657..7d29398499 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: fa1c3040-4680-11ec-a618-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `remote_process_instantiation_via_dcom_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_dcom_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators may leverage DCOM to start a process on remote systems, but this #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index c232684c6f..d6260a6597 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -26,54 +26,67 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 112638b4-4634-11ec-b9ab-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_process_instantiation_via_wmi_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index d180adff96..88d8a22cf3 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -26,53 +26,66 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 2a048c14-4634-11ec-a618-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -86,10 +99,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `remote_process_instantiation_via_wmi_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_wmi_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -126,7 +139,7 @@ Administrators may leverage WWMI and powershell.exe to start a process on remote #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index 5f9cf042b9..749164711c 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -27,53 +27,66 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-15 - **Author**: Michael Haag, Splunk - **ID**: d56fe0c8-4650-11ec-a8fa-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_diskcryptor_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ It is possible false positives may be present based on the internal name dcinst. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md index a3b01204b7..5f53f8d528 100644 --- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md +++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md @@ -27,53 +27,66 @@ This analytic is to detect a suspicious high frequency copying/moving of files i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 40925f12-4709-11ec-bb43-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1537](https://attack.mitre.org/techniques/T1537/) | Transfer Data to Cloud Account | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This analytic is to detect a suspicious high frequency copying/moving of files i The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `high_frequency_copy_of_files_in_network_share_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **high_frequency_copy_of_files_in_network_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ this behavior may seen in normal transfer of file within network if network shar #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index ce25f1e093..9f6179215b 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -29,18 +29,19 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-16 - **Author**: Mauricio Velazco, Splunk - **ID**: ba24cda8-4716-11ec-8009-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,11 +107,11 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `remote_process_instantiation_via_winrm_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md index 84c0e5ebfc..03b0f31d66 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 7d4c618e-4716-11ec-951c-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `remote_process_instantiation_via_winrm_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remote_process_instantiation_via_winrm_and_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index c1330f541e..a9d65d562c 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -29,18 +29,19 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-17 - **Author**: Michael Haag, Splunk - **ID**: 8567da9e-47f0-11ec-99a9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_dism_remove_defender_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Some legitimate administrative tools leverage `dism.exe` to manipulate packages #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 1d8ae90b58..2c8c829e66 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -29,17 +29,18 @@ The following analytic identifies executable files (.exe or .dll) being written - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-18 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: f63c34fe-a435-11eb-935a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic identifies executable files (.exe or .dll) being written | [T1021.002](https://attack.mitre.org/techniques/T1021/002/) | SMB/Windows Admin Shares | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `executable_file_written_in_administrative_smb_share_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ System Administrators may use looks like PsExec for troubleshooting or administr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index aa63a72257..c80c3e0ed1 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -32,17 +32,18 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-18 - **Author**: Teoderick Contreras, Splunk - **ID**: eac5e8ba-4857-11ec-9371-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win | [T1055.001](https://attack.mitre.org/techniques/T1055/001/) | Dynamic-link Library Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `loading_of_dynwrapx_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited, however it is possible to filter by Processes #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index 4b09e79d9d..46501b0957 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -27,53 +27,66 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-19 - **Author**: Teoderick Contreras, Splunk - **ID**: f92d74f2-4921-11ec-b685-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `system_info_gathering_using_dxdiag_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ This commandline can be used by a network administrator to audit host machine sp #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index b52b671bbd..cb2f6fef65 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -30,17 +30,18 @@ This analytic will detect if a suspicious process contains a commandline paramet - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ba484e8-4b97-11ec-b19a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic will detect if a suspicious process contains a commandline paramet | [T1555](https://attack.mitre.org/techniques/T1555/) | Credentials from Password Stores | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic will detect if a suspicious process contains a commandline paramet #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `possible_browser_pass_view_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ False positive is quite limited. Filter is needed #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index cb80574780..9cfdc8ebea 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -31,18 +31,19 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: ba9e1954-4c04-11ec-8b74-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `services_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 9c76803b89..5bd13df00c 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -34,17 +34,18 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,10 +111,10 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `svchost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index b42fa5741d..dc60511f07 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -29,17 +29,18 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-22 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 429141be-8311-11eb-adb6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t | [T1569.002](https://attack.mitre.org/techniques/T1569/002/) | Service Execution | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,7 +108,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_service_created_with_suspicious_service_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -134,7 +147,7 @@ Legitimate applications may install services with uncommon services paths. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 2d4c9c9344..022efd6778 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -31,17 +31,18 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_service_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -135,7 +148,7 @@ Legitimate applications may install services with uncommon services paths. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 9ef8a364df..7ffe682eb2 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -26,54 +26,67 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 95a455f0-4c04-11ec-b8ac-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wmiprsve_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index a3376cbbce..276d318044 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -29,18 +29,19 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 2eed004c-4c0d-11ec-93e8-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wsmprovhost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index b077eeadf7..b017b11469 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -29,18 +29,19 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-23 - **Author**: Mauricio Velazco, Splunk - **ID**: f6601940-4c74-11ec-b9b7-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. | [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `mmc_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index 571321f49f..936a9f865e 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -29,18 +29,19 @@ This analytic will identify a suspicious process command-line related to Windows - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 773b66fe-4dd9-11ec-8289-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic will identify a suspicious process command-line related to Windows | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ This analytic will identify a suspicious process command-line related to Windows #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `add_or_set_windows_defender_exclusion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Admin or user may choose to use this windows features. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index ea61def42a..fd9b2fd61b 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -30,17 +30,18 @@ This analytic will detect a suspicious process commandline related to windows de - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 907ac95c-4dd9-11ec-ba2c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic will detect a suspicious process commandline related to windows de | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_windows_defender_exclusion_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_windows_defender_exclusion_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ admin or user may choose to use this windows features. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md index c36ce26a0f..3ff630a630 100644 --- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md +++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md @@ -29,18 +29,19 @@ This analytic will detect a suspicious process that modify a registry related to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 13395a44-4dd9-11ec-9df7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic will detect a suspicious process that modify a registry related to | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic will detect a suspicious process that modify a registry related to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_defender_exclusion_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_defender_exclusion_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ admin or user may choose to use this windows features. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index 1a15494d63..6507540386 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -26,54 +26,67 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-29 - **Author**: Michael Haag, Splunk - **ID**: 32e0baea-b3f1-11eb-a2ce-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1020](https://attack.mitre.org/techniques/T1020/) | Automated Exfiltration | Exfiltration | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detect_rclone_command-line_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ False positives should be limited as this is restricted to the Rclone process na #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index fcc1a4ff8e..35abe42876 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -47,18 +47,19 @@ The following analytic assists with identifying a PowerShell process spawned as - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: cb909b3e-512b-11ec-aa31-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -76,37 +77,49 @@ The following analytic assists with identifying a PowerShell process spawned as | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -122,10 +135,10 @@ The following analytic assists with identifying a PowerShell process spawned as #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `possible_lateral_movement_powershell_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -173,7 +186,7 @@ Legitimate applications may spawn PowerShell as a child process of the the ident #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 397cf4e521..5c18f45018 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -35,17 +35,18 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: 9d22a780-5165-11ec-ad4f-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,37 +54,49 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `randomly_generated_scheduled_task_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **randomly_generated_scheduled_task_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Legitimate applications may use random Scheduled Task names. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index a42b2e0eec..b373d1d58f 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -33,17 +33,18 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: 2032a95a-5165-11ec-a2c3-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,37 +52,49 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,7 +111,7 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) -Note that `randomly_generated_windows_service_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **randomly_generated_windows_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Legitimate applications may use random Windows Service names. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index 5850d5741c..ccf60fde95 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -32,53 +32,66 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-12-01 - **Author**: Mauricio Velazco, Splunk - **ID**: ac3b81c0-52f4-11ec-ac44-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,7 +110,7 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `unusual_number_of_computer_service_tickets_requested_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusual_number_of_computer_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ An single endpoint requesting a large number of computer service tickets is not #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index bbfcc0c08b..4ddabc750f 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -32,53 +32,66 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-12-01 - **Author**: Mauricio Velazco, Splunk - **ID**: acb5dc74-5324-11ec-a36d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,7 +111,7 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `unusual_number_of_remote_endpoint_authentication_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusual_number_of_remote_endpoint_authentication_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ An single endpoint authenticating to a large number of hosts is not common behav #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md index 29db109fb6..2e30129165 100644 --- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md +++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md @@ -28,53 +28,66 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-12-03 - **Author**: Mauricio Velazco, Splunk - **ID**: 6fa31414-546e-11ec-adfa-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Scheduled Task | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,7 +106,7 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `short_lived_scheduled_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **short_lived_scheduled_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Although uncommon, legitimate applications may create and delete a Scheduled Tas #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index 7cedbd723d..2036a963e1 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -28,53 +28,66 @@ The search logic specifically looks for high number of distinct commands run in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-06 - **Author**: Bhavin Patel, Splunk - **ID**: 0edd5112-56c9-11ec-b990-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059.004](https://attack.mitre.org/techniques/T1059/004/) | Unix Shell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -94,10 +107,10 @@ The search logic specifically looks for high number of distinct commands run in #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_linux_discovery_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Unless an administrator is using these commands to troubleshoot or audit a syste #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md index 78e69b2f8b..55b2b6652c 100644 --- a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md +++ b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md @@ -35,17 +35,18 @@ The following query identifies suspicious .aspx created in 3 paths identified by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-07 - **Author**: Michael Haag, Splunk - **ID**: 985f322c-57a5-11ec-b9ac-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,37 +56,49 @@ The following query identifies suspicious .aspx created in 3 paths identified by | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -107,7 +120,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ms_exchange_mailbox_replication_service_writing_active_server_pages_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ The query is structured in a way that `action` (read, create) is not defined. Re #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index f667e69a6f..f299a1bfef 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -26,54 +26,67 @@ The following analytic identifies the Raccine Rules Updater scheduled task being - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-12-07 - **Author**: Michael Haag, Splunk - **ID**: c9f010da-57ab-11ec-82bd-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytic identifies the Raccine Rules Updater scheduled task being #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_raccine_scheduled_task_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ False positives should be limited, however filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index db4410e533..dfc9568416 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -39,17 +39,18 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-12-08 - **Author**: Michael Haag, Splunk - **ID**: ccb98a66-5851-11ec-b91c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -57,41 +58,53 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-41379](https://nvd.nist.gov/vuln/detail/CVE-2021-41379) | Windows Installer Elevation of Privilege Vulnerability | 4.6 | +
#### Search @@ -106,10 +119,10 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `msi_module_loaded_by_non-system_binary_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ It is possible some Administrative utilities will load msi.dll outside of normal #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index e9a33f83d7..9d5565668b 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -28,57 +28,70 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-10 - **Author**: Michael Haag, Splunk - **ID**: 900bc324-59f3-11ec-9fb4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -95,10 +108,10 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `curl_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited, however filtering may be required. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index acb8033f89..d1767dc18e 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -28,57 +28,70 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-11 - **Author**: Michael Haag, Splunk - **ID**: 35682718-5a85-11ec-b8f7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -95,10 +108,10 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `wget_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ False positives should be limited, however filtering may be required. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 5afb62db51..807b21055f 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -31,17 +31,18 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) - - **Last Updated**: 2021-12-13 - **Author**: Bhavin Patel, Johan Bjerke, Splunk - **ID**: 5e06e262-d7cd-4216-b2f8-27b437e18458 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,22 +50,28 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.DS * PR.PT * DE.AE @@ -72,27 +79,33 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use +
CIS20 +
+ * CIS 12 * CIS 13 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -111,7 +124,7 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_outbound_ldap_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_outbound_ldap_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Unknown at this moment. Outbound LDAP traffic should not be allowed outbound thr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index d05f194f96..967b055754 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -28,57 +28,70 @@ The following analytic identifies a Java user agent performing a GET request for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 8281ce42-5c50-11ec-82d2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -96,7 +109,7 @@ The following analytic identifies a Java user agent performing a GET request for The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `java_class_file_download_by_java_user_agent_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **java_class_file_download_by_java_user_agent_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Filtering may be required in some instances, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index ba9e3df2b3..fc6036bb7e 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -28,57 +28,70 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 7b09db8a-5c20-11ec-9945-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -94,11 +107,11 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_java_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Filtering may be required on internal developer build systems or classify assets #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 6bd14c9e1f..a73fcd86c1 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -28,64 +28,77 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2021-12-13 - **Author**: Jose Hernandez - **ID**: c184f12e-5c90-11ec-bf1f-497c9a704a72 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Reconnaissance * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -106,7 +119,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -Note that `log4shell_jndi_payload_injection_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **log4shell_jndi_payload_injection_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * action @@ -150,7 +163,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index 2640074d1d..f7896912d1 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -29,63 +29,76 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2021-12-13 - **Author**: Jose Hernandez - **ID**: 69afee44-5c91-11ec-bf1f-497c9a704a72 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -111,10 +124,10 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `log4shell_jndi_payload_injection_with_outbound_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * action @@ -158,7 +171,7 @@ If there is a vulnerablility scannner looking for log4shells this will trigger, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index e4cb65cb84..898543d1d4 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -27,57 +27,70 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2021-12-13 - **Author**: Mauricio Velazco, Splunk - **ID**: d2c14d28-5c47-11ec-9892-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -98,10 +111,10 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `outbound_network_connection_from_java_using_default_ports_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Legitimate Java applications may use perform outbound connections to these ports #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index dff6547824..e007877f83 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -30,57 +30,70 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 28c81306-5c47-11ec-bfea-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -97,10 +110,10 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) -Note that `windows_java_spawning_shells_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Filtering may be required on internal developer build systems or classify assets #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 36576f0fea..d60970e27e 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -38,57 +38,70 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) - - **Last Updated**: 2021-12-14 - **Author**: Michael Haag, Splunk - **ID**: 158b68fa-5d1a-11ec-aac8-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -218,7 +231,7 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort #### Macros The SPL above uses the following Macros: -Note that `hunting_for_log4shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **hunting_for_log4shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -263,7 +276,7 @@ It is highly possible you will find false positives, however, the base score is #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index 02a3655bda..3ad2b9f0a3 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -34,17 +34,18 @@ The following analytic identifies a suspicious file creation in known cron table - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 023f3452-5f27-11ec-bf00-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ The following analytic identifies a suspicious file creation in known cron table | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ The following analytic identifies a suspicious file creation in known cron table #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_add_files_in_known_crontab_directories_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrator or network operator can create file in crontab folders for automat #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index f117e57641..1988954c6e 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -34,17 +34,18 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 977b3082-5f3d-11ec-b954-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_at_allow_config_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can create this file for automation purposes. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md index 3241accc1c..15399f7704 100644 --- a/docs/_posts/2021-12-17-linux_at_application_execution.md +++ b/docs/_posts/2021-12-17-linux_at_application_execution.md @@ -34,17 +34,18 @@ The following analytic identifies a suspicious process creation of At applicatio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: bf0a378e-5f3c-11ec-a6de-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ The following analytic identifies a suspicious process creation of At applicatio | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ The following analytic identifies a suspicious process creation of At applicatio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_at_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Administrator or network operator can use this application for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 015d92f7d0..5dcf88553e 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -34,17 +34,18 @@ The following analytic identifies a suspicious cronjobs modification using cront - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 0d370304-5f26-11ec-a4bb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ The following analytic identifies a suspicious cronjobs modification using cront | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ The following analytic identifies a suspicious cronjobs modification using cront #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_edit_cron_table_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can use this application for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md index 3a4a1dcacd..302ab92b97 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md @@ -34,17 +34,18 @@ This analytic looks for suspicious commandline that may use to append user entry - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 7bc20606-5f40-11ec-a586-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for suspicious commandline that may use to append user entry | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for suspicious commandline that may use to append user entry #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_append_command_to_at_allow_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index c49d72f897..473119e53b 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -34,17 +34,18 @@ This analytic looks for possible suspicious commandline that may use to append a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: b5b91200-5f27-11ec-bb4e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for possible suspicious commandline that may use to append a | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for possible suspicious commandline that may use to append a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index 1307c5339b..c5a8a034a7 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -34,17 +34,18 @@ This analytic looks for possible modification of cronjobs file using editor. Thi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: dcc89bde-5f24-11ec-87ca-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for possible modification of cronjobs file using editor. Thi | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for possible modification of cronjobs file using editor. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_cronjob_modification_with_editor_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index c2d7a0a040..ddc781bd15 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -32,17 +32,18 @@ This analytic looks for suspicious file creation on init system directories for - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious file creation on init system directories for | [T1037](https://attack.mitre.org/techniques/T1037/) | Boot or Logon Initialization Scripts | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious file creation on init system directories for #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_file_creation_in_init_boot_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Administrator or network operator can create file in this folders for automation #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index da086a7669..a1e453bfe1 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -32,17 +32,18 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 46ba0082-61af-11ec-9826-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_file_creation_in_profile_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrator or network operator can create file in profile.d folders for autom #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index 704b3a68d8..2d585b9989 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -32,17 +32,18 @@ This analytic looks for suspicious command-lines that can be possibly used to mo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c94732a-61af-11ec-91e3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious command-lines that can be possibly used to mo | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious command-lines that can be possibly used to mo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_append_command_to_profile_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index 32378b2987..c8d4e2ed1e 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -34,17 +34,18 @@ This analytic looks for suspicious file creation in systemd timer directory in l - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: c7495048-61b6-11ec-9a37-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for suspicious file creation in systemd timer directory in l | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for suspicious file creation in systemd timer directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_service_file_created_in_systemd_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Administrator or network operator can create file in systemd folders for automat #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 487e481483..29b47b0992 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -34,17 +34,18 @@ This analytic looks for restarted or re-enable services in linux platform. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 084275ba-61b8-11ec-8d64-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for restarted or re-enable services in linux platform. This | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for restarted or re-enable services in linux platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_service_restarted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index bcc04521d6..d7dac183bd 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -34,17 +34,18 @@ This analytic looks for created or enable services in linux platform. This techn - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: e0428212-61b7-11ec-88a3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic looks for created or enable services in linux platform. This techn | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic looks for created or enable services in linux platform. This techn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_service_started_or_enabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md index 7926c64bfd..10d905a387 100644 --- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -38,17 +38,18 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Mauricio Velazco, Splunk - **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -56,35 +57,46 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | @@ -92,6 +104,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im +
#### Search @@ -106,7 +119,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `suspicious_computer_account_name_change_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_computer_account_name_change_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Renaming a computer account name to a name that not end with '$' is highly unsua #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md index 6c35b91e05..9afc56d003 100644 --- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -38,17 +38,18 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-20 - **Author**: Mauricio Velazco, Splunk - **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -56,35 +57,46 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-42287](https://nvd.nist.gov/vuln/detail/CVE-2021-42287) | Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291. | 6.5 | @@ -92,6 +104,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im +
#### Search @@ -108,7 +121,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `suspicious_kerberos_service_ticket_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_kerberos_service_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ We have tested this detection logic with ~2 million 4769 events and did not iden #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index a78908ea25..215aaa0b06 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -30,17 +30,18 @@ This analytic looks for commands to create user accounts on the linux platform. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 51fbcaf2-6259-11ec-b0f3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic looks for commands to create user accounts on the linux platform. | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic looks for commands to create user accounts on the linux platform. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_add_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index 4e316f09c6..787bf9cf07 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -30,17 +30,18 @@ This analytic looks for a commandline that change the file owner to root using c - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: c1400ea2-6257-11ec-ad49-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic looks for a commandline that change the file owner to root using c | [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic looks for a commandline that change the file owner to root using c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_change_file_owner_to_root_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index e015fd8a05..1435ec4b25 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -32,17 +32,18 @@ This analytic is to look for suspicious command lines that may add entry to /etc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: ab1e0d52-624a-11ec-8e0b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to look for suspicious command lines that may add entry to /etc | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to look for suspicious command lines that may add entry to /etc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_nopasswd_entry_in_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index 4d54550106..0a1f0db1f2 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -32,17 +32,18 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: bf0304b6-6250-11ec-9d7c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_setuid_using_chmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index 93a16f36e8..68d970d4fc 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -32,17 +32,18 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 9d96022e-6250-11ec-9a19-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_setuid_using_setcap_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 7f6b7d204e..d4b1ebd892 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -32,17 +32,18 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 08c41040-624c-11ec-a71f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_visudo_utility_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md index 4c9a96d701..458587f4f1 100644 --- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -36,17 +36,18 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-21 - **Author**: Mauricio Velazco, Splunk - **ID**: d77d349e-6269-11ec-9cfe-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -54,37 +55,49 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im | [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `suspicious_ticket_granting_ticket_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_ticket_granting_ticket_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ A computer account name change event inmediately followed by a kerberos TGT requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index f8a175fe32..e03f211383 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -32,17 +32,18 @@ This analytic looks for suspicious file creation in kernel/driver directory in l - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: b85bbeec-6326-11ec-9311-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for suspicious file creation in kernel/driver directory in l | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for suspicious file creation in kernel/driver directory in l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_file_created_in_kernel_driver_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can create file in this folders for automation #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index 4937503120..93b650fe0a 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -32,17 +32,18 @@ This analytic looks for inserting of linux kernel module using insmod utility fu - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 18b5a1a0-6326-11ec-943a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for inserting of linux kernel module using insmod utility fu | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for inserting of linux kernel module using insmod utility fu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_insert_kernel_module_using_insmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index 0a8bc9a3ba..2c8bf702b9 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -32,17 +32,18 @@ This analytic looks for possible installing a linux kernel module using modprobe - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 387b278a-6326-11ec-aa2c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic looks for possible installing a linux kernel module using modprobe | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic looks for possible installing a linux kernel module using modprobe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_install_kernel_module_using_modprobe_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index 7d2def2f24..b2ab9b1edc 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -34,17 +34,18 @@ This analytic is to detect a suspicious command that may hijack a library functi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: cbe2ca30-631e-11ec-8670-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,43 +53,55 @@ This analytic is to detect a suspicious command that may hijack a library functi | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,10 +117,10 @@ This analytic is to detect a suspicious command that may hijack a library functi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_preload_hijack_library_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index 7db5043a0b..b12a2f9c59 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -32,17 +32,18 @@ This analytic is to look for possible elevation control access using a common kn - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 66ab15c0-63d0-11ec-9e70-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to look for possible elevation control access using a common kn | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to look for possible elevation control access using a common kn #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_common_process_for_elevation_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 4e6149c0d3..5ecd7ddeb9 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -32,17 +32,18 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2021-12-23 - **Author**: Teoderick Contreras, Splunk - **ID**: be254a5c-63e7-11ec-89da-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_sudoers_tmp_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index 986218fb92..a4091d5bd5 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -32,17 +32,18 @@ This analytic is to detect the execution of sudo or su command in linux operatin - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 4b00f134-6d6a-11ec-a90c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to detect the execution of sudo or su command in linux operatin | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to detect the execution of sudo or su command in linux operatin #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_sudo_or_su_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index 3fd29214a6..fed38517b7 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -32,17 +32,18 @@ This analytic is to detect the creation of doas.conf file in linux host platform - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-05 - **Author**: Teoderick Contreras, Splunk - **ID**: f6343e86-6e09-11ec-9376-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to detect the creation of doas.conf file in linux host platform | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to detect the creation of doas.conf file in linux host platform #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_doas_conf_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index 7f1ac860cf..1599d008a8 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -32,17 +32,18 @@ This analytic is to detect the doas tool execution in linux host platform. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-05 - **Author**: Teoderick Contreras, Splunk - **ID**: d5a62490-6e09-11ec-884e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to detect the doas tool execution in linux host platform. This | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to detect the doas tool execution in linux host platform. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_doas_tool_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index d0d1fa0dc8..8abacad923 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -30,17 +30,18 @@ This analytic is to detect a possible attempt to dump or access the content of / - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 16107e0e-71fc-11ec-b862-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic is to detect a possible attempt to dump or access the content of / | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic is to detect a possible attempt to dump or access the content of / #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_access_to_credential_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index a8fa6c467d..d32def4018 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -32,17 +32,18 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 4479539c-71fc-11ec-b2e2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_access_to_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index 2d067c2617..646b74e3e7 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -30,17 +30,18 @@ This analytic is to look for suspicious process command-line that might be acces - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 7a85eb24-72da-11ec-ac76-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic is to look for suspicious process command-line that might be acces | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic is to look for suspicious process command-line that might be acces #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_access_or_modification_of_sshd_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrator or network operator can use this commandline for automation purpos #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index 1e5a01dfbf..44b67839f1 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -30,17 +30,18 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-11 - **Author**: Teoderick Contreras, Splunk - **ID**: c04ef40c-72da-11ec-8eac-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T | [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_possible_ssh_key_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Administrator or network operator can create file in ~/.ssh folders for automati #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index 1598b5aea3..4c67bd562e 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -31,17 +31,18 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-12 - **Author**: David Dorsey, Michael Haag Splunk - **ID**: ee18ed37-0802-4268-9435-b3b91aaa18db -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,50 +50,62 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 8 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -113,11 +126,11 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `powershell_-_connect_to_internet_with_hidden_window_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -161,7 +174,7 @@ Legitimate process can have this combination of command-line options, but it's n #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 3d5cf30d78..cd569b7713 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -29,17 +29,18 @@ The following hunting analytic identifies all processes requesting access into L - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-01-12 - **Author**: Michael Haag, Splunk - **ID**: 1c6abb08-73d1-11ec-9ca0-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,40 +48,52 @@ The following hunting analytic identifies all processes requesting access into L | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following hunting analytic identifies all processes requesting access into L #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_hunting_system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ False positives will occur based on GrantedAccess and SourceUser, filter based o #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index d2d9f764eb..60c7093de5 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -29,17 +29,18 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-01-12 - **Author**: Michael Haag, Splunk - **ID**: b1ce9a72-73cf-11ec-981b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,40 +48,52 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_non-system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ False positives will occur based on legitimate application requests, filter base #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 96293d5585..5834b33c54 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -26,54 +26,67 @@ The following analytic uses a pretrained machine learning text classifier to det - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-14 - **Author**: Michael Hart, Splunk - **ID**: 9c53c446-757e-11ec-871d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059.003](https://attack.mitre.org/techniques/T1059/003/) | Windows Command Shell | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `potentially_malicious_code_on_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ This model is an anomaly detector that identifies usage of APIs and scripting co #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 760441b8a0..98613c6f1f 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -31,17 +31,18 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Bhavin Patel, Splunk - **ID**: 54a6ed00-3256-11ec-b031-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. | 9.3 | +
#### Search @@ -99,11 +112,11 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `cmd_carry_out_string_command_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ False positives may be high based on legitimate scripted code in any environment #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index 7ed41813ea..cbc824d6df 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -39,18 +39,19 @@ This analytic looks for the presence of suspicious commandline parameters typica - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-18 - **Author**: Mauricio Velazco, Splunk - **ID**: 8ce07472-496f-11ec-ab3b-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -64,37 +65,49 @@ This analytic looks for the presence of suspicious commandline parameters typica | [T1543.003](https://attack.mitre.org/techniques/T1543/003/) | Windows Service | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -110,10 +123,10 @@ This analytic looks for the presence of suspicious commandline parameters typica #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `impacket_lateral_movement_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -164,7 +177,7 @@ Although uncommon, Administrators may leverage Impackets tools to start a proces #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index bea8e25fcc..f6f72a2a16 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -30,62 +30,75 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-18 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: c4db14d9-7909-48b4-a054-aa14d89dbb19 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * PR.IP +
CIS20 +
+ * CIS 3 * CIS 7 * CIS 8 +
CVE +
+
#### Search @@ -106,11 +119,11 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `malicious_powershell_process_-_encoded_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -154,7 +167,7 @@ System administrators may use this option, but it's not common. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index bdaf70c274..abc63bd53c 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -30,17 +30,18 @@ This analytic will identify a suspicious PowerShell command used to delete the W - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Splunk - **ID**: adf47620-79fa-11ec-b248-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic will identify a suspicious PowerShell command used to delete the W | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `powershell_remove_windows_defender_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index 17b9a792b9..20ea3aa0e0 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -30,17 +30,18 @@ This analytic detects a suspicious process making a DNS query via known, abused - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Splunk - **ID**: 3cf0dc36-484d-11ec-a6bc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a suspicious process making a DNS query via known, abused | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This analytic detects a suspicious process making a DNS query via known, abused #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_process_dns_query_known_abuse_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Noise and false positive can be seen if the following instant messaging is allow #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md index afeaedbe94..c102f70073 100644 --- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md @@ -30,17 +30,18 @@ This analytic identifies a process making a DNS query to Discord, a well known i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 4d4332ae-792c-11ec-89c1-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic identifies a process making a DNS query to Discord, a well known i | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This analytic identifies a process making a DNS query to Discord, a well known i #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_process_with_discord_dns_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Noise and false positive can be seen if the following instant messaging is allow #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index 63a66a877d..96a3006763 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -35,18 +35,19 @@ The following analytic identifies native .net binaries within the Windows operat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-19 - **Author**: Michael Haag, Splunk - **ID**: fddf3b56-7933-11ec-98a6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,37 +59,49 @@ The following analytic identifies native .net binaries within the Windows operat | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -105,11 +118,11 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_dotnet_binary_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,7 +172,7 @@ False positives may be present and filtering may be required. Certain utilities #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index ff76c5223c..e887c103b9 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -35,18 +35,19 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-19 - **Author**: Michael Haag, Splunk - **ID**: dcf74b22-7933-11ec-857c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,37 +59,49 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro | [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -104,11 +117,11 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,7 +172,7 @@ False positives may be present and filtering may be required. Certain utilities #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 2200be8f16..19efd5ad59 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -27,59 +27,72 @@ This analytic will identify excessive file deletion events in the Windows Defend - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-20 - **Author**: Teoderick Contreras, Splunk - **ID**: b5baa09a-7a05-11ec-8da4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic will identify excessive file deletion events in the Windows Defend #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_file_deletion_in_windefender_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Windows Defender AV updates may cause this alert. Please update the filter macro #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index ad99637990..fb4539a7d4 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -31,18 +31,19 @@ This analytic will identify the possible execution of ping sleep batch commands. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-20 - **Author**: Teoderick Contreras, Splunk - **ID**: ce058d6c-79f2-11ec-b476-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ This analytic will identify the possible execution of ping sleep batch commands. | [T1497.003](https://attack.mitre.org/techniques/T1497/003/) | Time Based Evasion | Defense Evasion, Discovery | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -103,10 +116,10 @@ This analytic will identify the possible execution of ping sleep batch commands. #### Macros The SPL above uses the following Macros: * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `ping_sleep_batch_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ Administrator or network operator may execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index c0aa375d5d..2e355530e0 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -26,54 +26,67 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-21 - **Author**: Michael Haag, Splunk - **ID**: bb4f3090-7ae4-11ec-897f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1588.002](https://attack.mitre.org/techniques/T1588/002/) | Tool | Resource Development | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_nirsoft_advancedrun_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ False positives should be limited as it is specific to AdvancedRun. Filter as ne #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index d8bb2df951..58c3176a80 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -27,53 +27,66 @@ The following hunting analytic assists with identifying the proces execution of - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-24 - **Author**: Michael Haag, Splunk - **ID**: 5b2f4596-7d4c-11ec-88a7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1588.002](https://attack.mitre.org/techniques/T1588/002/) | Tool | Resource Development | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following hunting analytic assists with identifying the proces execution of #### Macros The SPL above uses the following Macros: * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_nirsoft_utilities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ False positives may be present. Filtering may be required before setting to aler #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md index 349e3fb759..0a50b83139 100644 --- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md +++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md @@ -31,18 +31,19 @@ This analytic is to detect a suspicious modification of the active setup registr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: f64579c0-203f-11ec-abcc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic is to detect a suspicious modification of the active setup registr | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This analytic is to detect a suspicious modification of the active setup registr The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `active_setup_registry_autostart_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **active_setup_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Active setup installer may add or modify this registry. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md index f60a8e8be8..e3b95c3a2e 100644 --- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md @@ -29,18 +29,19 @@ this search is to detect a suspicious registry modification to implement auto ad - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: d4a3eb62-0f1e-11ec-a971-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to detect a suspicious registry modification to implement auto ad | [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to detect a suspicious registry modification to implement auto ad The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `add_defaultuser_and_password_in_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **add_defaultuser_and_password_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md index 6bd7ea15ac..6b15eb1683 100644 --- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -29,18 +29,19 @@ This analytic detects a potential suspicious modification of firewall rule regis - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 0a46537c-be02-11eb-92ca-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a potential suspicious modification of firewall rule regis | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -108,7 +121,7 @@ This analytic detects a potential suspicious modification of firewall rule regis The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `allow_inbound_traffic_by_firewall_rule_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md index 5725bd73ac..9a1430e0b4 100644 --- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md +++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md @@ -27,54 +27,67 @@ This analytic identifies a potential privilege escalation attempt to perform mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 7de17d7a-c9d8-11eb-a812-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,7 +110,7 @@ This analytic identifies a potential privilege escalation attempt to perform mal The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `allow_operation_with_consent_admin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **allow_operation_with_consent_admin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md index a72678dbdc..37c0dec2bc 100644 --- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md +++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md @@ -29,18 +29,19 @@ this search is to identify modification in registry to disable AMSI windows feat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c27ec42-d338-11eb-9044-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to identify modification in registry to disable AMSI windows feat | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to identify modification in registry to disable AMSI windows feat The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_amsi_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_amsi_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ network operator may disable this feature of windows but not so common. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md index 9a9c9a3e76..bffbcade84 100644 --- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md @@ -29,18 +29,19 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: aa4f695a-3024-11ec-9987-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This particular behavior is typically executed when an adversaries or malware ga | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_antivirus_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_antivirus_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md index 8469cfad99..445864c986 100644 --- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras - **ID**: 2dd719ac-3021-11ec-97b4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious modification of registry to disable wind | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_blockatfirstseen_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_blockatfirstseen_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md index 189185afe5..c5989899fc 100644 --- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md +++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: dc65678c-301f-11ec-8e30-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious modification of registry to disable wind | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_enhanced_notification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_enhanced_notification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ user may choose to disable windows defender AV #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md index 228f2f18ec..15e3fd8575 100644 --- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md @@ -29,18 +29,19 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: cc391750-3024-11ec-955a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This particular behavior is typically executed when an adversaries or malware ga | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_mpengine_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_mpengine_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md index 68eea525b1..dc514fd914 100644 --- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md +++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 898debf4-3021-11ec-ba7c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious modification of registry to disable wind | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic is to detect a suspicious modification of registry to disable wind The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_spynet_reporting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_spynet_reporting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md index acca7c302e..454633eecb 100644 --- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md @@ -29,18 +29,19 @@ his analytic is to detect a suspicious modification of registry to disable windo - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 73922ff8-3022-11ec-bf5e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ his analytic is to detect a suspicious modification of registry to disable windo | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ his analytic is to detect a suspicious modification of registry to disable windo The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_defender_submit_samples_consent_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_defender_submit_samples_consent_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index c4c9a38882..66e6fd519f 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -33,17 +33,18 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk) - - **Last Updated**: 2022-01-26 - **Author**: Jose Hernandez, Splunk - **ID**: 9be30d80-3a39-4df9-9102-64a467b24eac -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,44 +54,56 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Reconnaissance * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -108,10 +121,10 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `log4shell_cve-2021-44228_exploitation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ There are no known false positive for this search, but it could contain false po #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md index 7350510a25..5fbda3fafd 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md @@ -31,18 +31,19 @@ The search looks for modifications to registry keys that can be used to launch a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,43 +51,55 @@ The search looks for modifications to registry keys that can be used to launch a | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM * DE.AE +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -109,7 +122,7 @@ The search looks for modifications to registry keys that can be used to launch a The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `registry_keys_used_for_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **registry_keys_used_for_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ There are many legitimate applications that must execute on system startup and w #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md index f10c933998..e6d431404f 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md @@ -31,17 +31,18 @@ This search looks for modifications to registry keys that can be used to elevate - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-01-26 - **Author**: David Dorsey, Teoderick Contreras, Splunk - **ID**: c9f4b923-f8af-4155-b697-1354f5bcbc5e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,42 +50,54 @@ This search looks for modifications to registry keys that can be used to elevate | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -107,7 +120,7 @@ This search looks for modifications to registry keys that can be used to elevate The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `registry_keys_used_for_privilege_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **registry_keys_used_for_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ There are many legitimate applications that must execute upon system startup and #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md index f28433bc98..1adffa92dd 100644 --- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md +++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md @@ -26,54 +26,67 @@ This search detects registry key license at host where Remcos RAT agent is insta - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk - **ID**: f2a1615a-1d63-11ec-97d2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This search detects registry key license at host where Remcos RAT agent is insta The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `remcos_client_registry_install_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **remcos_client_registry_install_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -133,7 +146,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md index 2fceca2df0..da8d3e6238 100644 --- a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md +++ b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md @@ -31,18 +31,19 @@ This search is to detect a modification or registry add to the safeboot registry - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: c6149154-c9d8-11eb-9da7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect a modification or registry add to the safeboot registry | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This search is to detect a modification or registry add to the safeboot registry The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `start_up_during_safe_mode_boot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **start_up_during_safe_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ updated windows application needed in safe boot may used this registry #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md index 9ccb56eb3f..f2cee72117 100644 --- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md +++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md @@ -31,18 +31,19 @@ This analytic is to detect a suspicious modification of time provider registry f - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ba382c4-2105-11ec-8d8f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic is to detect a suspicious modification of time provider registry f | [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This analytic is to detect a suspicious modification of time provider registry f The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `time_provider_persistence_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **time_provider_persistence_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md index 9b1605d3aa..af7c242b10 100644 --- a/docs/_posts/2022-01-27-disable_etw_through_registry.md +++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md @@ -29,18 +29,19 @@ this search is to identify modification in registry to disable ETW windows featu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: f0eacfa4-d33f-11eb-8f9d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to identify modification in registry to disable ETW windows featu | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to identify modification in registry to disable ETW windows featu The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_etw_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_etw_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ network operator may disable this feature of windows but not so common. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md index 954d510e2b..2a00074acb 100644 --- a/docs/_posts/2022-01-27-disable_registry_tool.md +++ b/docs/_posts/2022-01-27-disable_registry_tool.md @@ -29,18 +29,19 @@ This search identifies modification of registry to disable the regedit or regist - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: cd2cf33c-9201-11eb-a10a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search identifies modification of registry to disable the regedit or regist | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search identifies modification of registry to disable the regedit or regist The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_registry_tool_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_registry_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md index 23068fa234..b00eb3f506 100644 --- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md +++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md @@ -26,54 +26,67 @@ This analytic is to detect a suspicious registry modification to disable securit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 39ebdc68-25b9-11ec-aec7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This analytic is to detect a suspicious registry modification to disable securit The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_security_logs_using_minint_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_security_logs_using_minint_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md index a03163474f..6719359e64 100644 --- a/docs/_posts/2022-01-27-disable_show_hidden_files.md +++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md @@ -36,17 +36,18 @@ The following analytic is to identify a modification in the Windows registry to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,37 +59,49 @@ The following analytic is to identify a modification in the Windows registry to | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -111,7 +124,7 @@ The following analytic is to identify a modification in the Windows registry to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_show_hidden_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_show_hidden_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md index 079d5d9a12..118662d9f8 100644 --- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md +++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md @@ -31,18 +31,19 @@ This analytic is to detect a suspicious modification of registry to disable UAC - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 9928b732-210e-11ec-b65e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This analytic is to detect a suspicious modification of registry to disable UAC | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_uac_remote_restriction_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_uac_remote_restriction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ admin may set this policy for non-critical machine. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md index 344bcb86bb..4fd93e7b84 100644 --- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md +++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md @@ -29,18 +29,19 @@ This analytic detects a suspicious registry modification to disable Windows hotk - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 1490f224-ad8b-11eb-8c4f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic detects a suspicious registry modification to disable Windows hotk | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_windows_app_hotkeys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_windows_app_hotkeys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md index 7cf342758a..5ea594d624 100644 --- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md @@ -29,18 +29,19 @@ This search is to identifies a modification in registry to disable the windows d - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 79439cae-9200-11eb-a4d3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identifies a modification in registry to disable the windows d | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search is to identifies a modification in registry to disable the windows d The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_windows_behavior_monitoring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_windows_behavior_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ admin or user may choose to disable this windows features. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md index 5d555464cc..d1e572600f 100644 --- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md @@ -30,17 +30,18 @@ The following search identifies a modification of registry to disable the smarts - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 664f0fd0-91ff-11eb-a56f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following search identifies a modification of registry to disable the smarts | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The following search identifies a modification of registry to disable the smarts The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disable_windows_smartscreen_protection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disable_windows_smartscreen_protection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin or user may choose to disable this windows features. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md index 508b51e100..9230cc7fe0 100644 --- a/docs/_posts/2022-01-27-disabling_cmd_application.md +++ b/docs/_posts/2022-01-27-disabling_cmd_application.md @@ -29,18 +29,19 @@ this search is to identify modification in registry to disable cmd prompt applic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: ff86077c-9212-11eb-a1e6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to identify modification in registry to disable cmd prompt applic | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to identify modification in registry to disable cmd prompt applic The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_cmd_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_cmd_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md index e54b1f1cc6..b3cb359185 100644 --- a/docs/_posts/2022-01-27-disabling_controlpanel.md +++ b/docs/_posts/2022-01-27-disabling_controlpanel.md @@ -29,18 +29,19 @@ this search is to identify registry modification to disable control panel window - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 6ae0148e-9215-11eb-a94a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ this search is to identify registry modification to disable control panel window | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ this search is to identify registry modification to disable control panel window The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_controlpanel_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_controlpanel_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index f7cbc0601a..f3f96dfe7f 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -33,17 +33,18 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-01-27 - **Author**: Michael Haag, Splunk - **ID**: e4723b92-7266-11ec-af45-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,40 +52,52 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.AE * DE.CM +
CIS20 +
+ +
CVE +
+
#### Search @@ -100,10 +113,10 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_possible_credential_dumping_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter base #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md index c4bd00ffb4..81e871dea0 100644 --- a/docs/_posts/2022-01-28-disabling_defender_services.md +++ b/docs/_posts/2022-01-28-disabling_defender_services.md @@ -29,18 +29,19 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 911eacdc-317f-11ec-ad30-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This particular behavior is typically executed when an adversaries or malware ga | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This particular behavior is typically executed when an adversaries or malware ga The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_defender_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_defender_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin or user may choose to disable windows defender product #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md index 4609abd789..45fbb3493a 100644 --- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md @@ -30,17 +30,18 @@ This search is to identify registry modification to disable folder options featu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 83776de4-921a-11eb-868a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identify registry modification to disable folder options featu | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search is to identify registry modification to disable folder options featu The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_folderoptions_windows_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_folderoptions_windows_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md index 4e68090fa7..4c6efe7aa2 100644 --- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md +++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md @@ -29,18 +29,19 @@ This search is to identify modification of registry to disable run application i - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: de81bc46-9213-11eb-adc9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identify modification of registry to disable run application i | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search is to identify modification of registry to disable run application i The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_norun_windows_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_norun_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md index 3c1b2a3bd3..c2841caa9f 100644 --- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md @@ -29,18 +29,19 @@ The following search identifies the modification of registry related in disablin - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: f4f837e2-91fb-11eb-8bf6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The following search identifies the modification of registry related in disablin | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The following search identifies the modification of registry related in disablin The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_systemrestore_in_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_systemrestore_in_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ in some cases admin can disable systemrestore on a machine. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md index 88cd189708..426d618a78 100644 --- a/docs/_posts/2022-01-28-disabling_task_manager.md +++ b/docs/_posts/2022-01-28-disabling_task_manager.md @@ -29,18 +29,19 @@ This search is to identifies modification of registry to disable the task manage - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: dac279bc-9202-11eb-b7fb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to identifies modification of registry to disable the task manage | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This search is to identifies modification of registry to disable the task manage The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `disabling_task_manager_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabling_task_manager_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ admin may disable this application for non technical user. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md index e0e8433f8f..62e1bb047f 100644 --- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md @@ -26,54 +26,67 @@ This search is to detect a modification to registry to enable rdp to a machine w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 99495452-b899-11eb-96dc-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This search is to detect a modification to registry to enable rdp to a machine w The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `enable_rdp_in_other_port_number_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **enable_rdp_in_other_port_number_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md index 35ddf277ba..8a72674d56 100644 --- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md +++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md @@ -29,18 +29,19 @@ This analytic is to detect a suspicious registry modification to enable plain te - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 0c7d8ffe-25b1-11ec-9f39-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic is to detect a suspicious registry modification to enable plain te | [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic is to detect a suspicious registry modification to enable plain te The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `enable_wdigest_uselogoncredential_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **enable_wdigest_uselogoncredential_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md index e73d99a0e6..0ac57dfcc9 100644 --- a/docs/_posts/2022-01-28-etw_registry_disabled.md +++ b/docs/_posts/2022-01-28-etw_registry_disabled.md @@ -32,18 +32,19 @@ This analytic is to detect a registry modification to disable ETW feature of win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ed523ac-276b-11ec-ac39-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -53,37 +54,49 @@ This analytic is to detect a registry modification to disable ETW feature of win | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -106,7 +119,7 @@ This analytic is to detect a registry modification to disable ETW feature of win The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `etw_registry_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **etw_registry_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md index 0f1243ef12..761074079b 100644 --- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md +++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md @@ -31,18 +31,19 @@ The following search identifies Eventvwr bypass by identifying the registry modi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Michael Haag, Splunk - **ID**: 9cf8fe08-7ad8-11eb-9819-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The following search identifies Eventvwr bypass by identifying the registry modi | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `eventvwr_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **eventvwr_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ Some false positives may be present and will need to be filtered. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md index ce58a22693..7058104289 100644 --- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md @@ -29,18 +29,19 @@ This analytic identifies a suspicious registry modification to hide a user accou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 834ba832-ad89-11eb-937d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This analytic identifies a suspicious registry modification to hide a user accou | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,7 +114,7 @@ This analytic identifies a suspicious registry modification to hide a user accou The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `hide_user_account_from_sign-in_screen_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **hide_user_account_from_sign-in_screen_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Unknown. Filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index 05c5354d1d..98c5d90bf3 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -28,57 +28,70 @@ The following analytic identifies `pkexec` spawning with no command-line argumen - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-01-28 - **Author**: Michael Haag, Splunk - **ID**: 03e22c1c-8086-11ec-ac2e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/CVE-2021-4034) | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. | 7.2 | +
#### Search @@ -95,10 +108,10 @@ The following analytic identifies `pkexec` spawning with no command-line argumen #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_pkexec_privilege_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ False positives may be present, filter as needed. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index 33b3f8d090..9c374923f6 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -32,17 +32,18 @@ The following analytic looks for the use of Mimikatz command line parameters lev - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 13bbd574-83ac-11ec-99d4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ The following analytic looks for the use of Mimikatz command line parameters lev | [T1550.003](https://attack.mitre.org/techniques/T1550/003/) | Pass the Ticket | Defense Evasion, Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic looks for the use of Mimikatz command line parameters lev #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `mimikatz_passtheticket_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Although highly unlikely, legitimate applications may use the same command line #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index 7421ff0d23..e9fa2bc27b 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -41,17 +41,18 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-01 - **Author**: Mauricio Velazco, Splunk - **ID**: cca37478-8377-11ec-b59a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -65,37 +66,49 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad | [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -111,10 +124,10 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rubeus_command_line_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,7 +169,7 @@ Although unlikely, legitimate applications may use the same command line paramet #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md index a131ae32a4..5ca0057953 100644 --- a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md @@ -36,17 +36,18 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-01 - **Author**: Michael Haag, Splunk - **ID**: 7360137f-abad-473e-8189-acbdaa34d114 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,42 +59,54 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec | [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -110,10 +123,10 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_rundll32_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -159,7 +172,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index bff12d1cb2..8a7b6a777c 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -26,54 +26,67 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-03 - **Author**: Michael Haag, Splunk - **ID**: 415b4306-8bfb-11eb-85c4-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -Note that `certutil_download_with_urlcache_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Limited false positives in most environments, however tune as needed based on pa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index e6600742a7..e16582243b 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -26,54 +26,67 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-03 - **Author**: Michael Haag, Splunk - **ID**: 801ad9e4-8bfb-11eb-8b31-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,11 +102,11 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T #### Macros The SPL above uses the following Macros: -* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml) -Note that `certutil_download_with_verifyctl_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -141,7 +154,7 @@ Limited false positives in most environments, however tune as needed based on pa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index 086acbeffa..aa4f03c7bd 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -29,17 +29,18 @@ This search detects the creation of a new Federation setting by alerting about a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-03 - **Author**: Rod Soto, Splunk - **ID**: 1668812a-6047-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search detects the creation of a new Federation setting by alerting about a | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,10 +105,10 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_added_service_principal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_added_service_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ The creation of a new Federation is not necessarily malicious, however these eve #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 4f18280991..56227cb9c5 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -29,17 +29,18 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-03 - **Author**: Bhavin Patel, Splunk - **ID**: c783dd98-c703-4252-9e8a-f19d9f66949e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -97,10 +110,10 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_bypass_mfa_via_trusted_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_bypass_mfa_via_trusted_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ Unless it is a special case, it is uncommon to continually update Trusted IPs to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index b79e4d83bb..12662ec347 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -28,53 +28,66 @@ This search detects when multi factor authentication has been disabled, what ent - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-03 - **Author**: Rod Soto, Splunk - **ID**: c783dd98-c703-4252-9e8a-f19d9f5c949e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -89,10 +102,10 @@ This search detects when multi factor authentication has been disabled, what ent #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_disable_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_disable_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Unless it is a special case, it is uncommon to disable MFA or Strong Authenticat #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index e925815886..db38882aa7 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -31,17 +31,18 @@ The following analytic looks for a process accessing the winlogon.exe system pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 5ed8c50a-8869-11ec-876f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,37 +50,49 @@ The following analytic looks for a process accessing the winlogon.exe system pro | [T1550.003](https://attack.mitre.org/techniques/T1550/003/) | Pass the Ticket | Defense Evasion, Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -95,10 +108,10 @@ The following analytic looks for a process accessing the winlogon.exe system pro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Legitimate applications may obtain a handle for winlogon.exe. Filter as needed #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index 8fc0bf9cf1..da7d2c0e50 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -28,53 +28,66 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-07 - **Author**: Michael Haag, Splunk - **ID**: ced50492-8849-11ec-9f68-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) -Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ False positives should be limited, filter as needed. Add additional shells as ne #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 5e4e3c087c..e1dd2d287a 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -34,17 +34,18 @@ The following analytic identifies Schtasks.exe creating a new task to start and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-07 - **Author**: Michael Haag, Splunk - **ID**: 41a0e58e-884c-11ec-9976-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ The following analytic identifies Schtasks.exe creating a new task to start and | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -99,10 +112,10 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) -Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ False positives will be limited to legitimate applications creating a task to ru #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index 10e231d978..35cd16df7b 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -30,17 +30,18 @@ The following analytic identifies rundll32.exe loading an export function by ord - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-08 - **Author**: Michael Haag, David Dorsey, Splunk - **ID**: 6c135f8d-5e60-454e-80b7-c56eed739833 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies rundll32.exe loading an export function by ord | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Installation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -149,7 +162,7 @@ False positives are possible with native utilities and third party applications. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md index 0764bb1dbf..d7cc33cf1c 100644 --- a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md +++ b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md @@ -30,17 +30,18 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-08 - **Author**: Mauricio Velazco, Splunk - **ID**: eb3e6702-8936-11ec-98fe-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ The detection calculates the standard deviation for each host and leverages the | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -98,7 +111,7 @@ The detection calculates the standard deviation for each host and leverages the The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `unusual_number_of_kerberos_service_tickets_requested_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **unusual_number_of_kerberos_service_tickets_requested_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ An single endpoint requesting a large number of kerberos service tickets is not #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 3a181d45b5..7be28a30c8 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -29,17 +29,18 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-09 - **Author**: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk - **ID**: 5cc67381-44fa-4111-8a37-7a230943f027 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket | [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 * CIS 16 +
CVE +
+
#### Search @@ -97,10 +110,10 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `kerberoasting_spn_request_with_rc4_encryption_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Older systems that support kerberos RC4 by default like NetApp may generate fals #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md index 634f692ff6..2dacb89f78 100644 --- a/docs/_posts/2022-02-11-linux_system_network_discovery.md +++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md @@ -27,59 +27,72 @@ This analytic is to look for possible enumeration of local network configuration - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 535cb214-8b47-11ec-a2c7-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1016](https://attack.mitre.org/techniques/T1016/) | System Network Configuration Discovery | Discovery | +
Kill Chain Phase +
+ * Reconnaissance +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -96,7 +109,7 @@ This analytic is to look for possible enumeration of local network configuration The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `linux_system_network_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_system_network_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index c94bf11826..9d6dac3223 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -27,59 +27,72 @@ This analytic is to look for dd command to overwrite file. This technique was ab - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-14 - **Author**: Teoderick Contreras, Splunk - **ID**: 9b6aae5e-8d85-11ec-b2ae-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -95,10 +108,10 @@ This analytic is to look for dd command to overwrite file. This technique was ab #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `linux_dd_file_overwrite_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Administrator or network operator can execute this command. Please update the fi #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md index 5a0fa2c826..e95f131154 100644 --- a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md +++ b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md @@ -28,59 +28,72 @@ NOTE:Deprecated because existing detection is doing the same. This detection is - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) - - **Last Updated**: 2022-02-15 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499f-9719-17a43f9826f4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1048.003](https://attack.mitre.org/techniques/T1048/003/) | Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol | Exfiltration | +
Kill Chain Phase +
+ * Command & Control * Actions on Objectives +
NIST +
+ * PR.PT * PR.DS +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -105,7 +118,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `detection_of_dns_tunnels_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detection_of_dns_tunnels_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ It's possible that normal DNS traffic will exhibit this behavior. If an alert is #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index 2892c85ede..c6a5449ad3 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -27,57 +27,70 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-15 - **Author**: Lou Stella, Splunk - **ID**: 58adae9e-8ea3-11ec-90f6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -93,11 +106,11 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_diskshadow_proxy_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Administrators using the DiskShadow tool in their infrastructure as a main backu #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index c1e68303ce..9bec2a26f5 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -35,17 +35,18 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-15 - **Author**: Michael Haag, Splunk - **ID**: 6f42b8be-8e96-11ec-ad5a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -55,37 +56,49 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -101,10 +114,10 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_rasautou_dll_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ False positives will be limited to applications that require Rasautou.exe to loa #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md index 369cf02432..87e4320c37 100644 --- a/docs/_posts/2022-02-17-windows_disable_notification_center.md +++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md @@ -27,58 +27,71 @@ The following search identifies a modification of registry to disable the window - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 1cd983c8-8fd6-11ec-a09d-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -101,7 +114,7 @@ The following search identifies a modification of registry to disable the window The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_notification_center_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_notification_center_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ admin or user may choose to disable this windows features. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index ebcd12f190..d26ce75104 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -30,17 +30,18 @@ This analytic is to look for suspicious raw access read to drive where the maste - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 7b83f666-900c-11ec-a2d9-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic is to look for suspicious raw access read to drive where the maste | [T1561](https://attack.mitre.org/techniques/T1561/) | Disk Wipe | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This analytic is to look for suspicious raw access read to drive where the maste #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_raw_access_to_master_boot_record_drive_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ This event is really notable but we found minimal number of normal application f #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 6df50c3f2c..697c39bd16 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -29,17 +29,18 @@ The following analytic identifies regasm.exe with a network connection to a publ - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-18 - **Author**: Michael Haag, Splunk - **ID**: 07921114-6db4-4e2e-ae58-3ea8a52ae93f -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ The following analytic identifies regasm.exe with a network connection to a publ | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ The following analytic identifies regasm.exe with a network connection to a publ #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regasm_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index b7ac45133b..24486be582 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -29,17 +29,18 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-18 - **Author**: Michael Haag, Splunk - **ID**: e3e7a1c0-f2b9-445c-8493-f30a63522d1a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,42 +48,54 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -98,10 +111,10 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regsvcs_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index b7e022a0c4..68ec5a3cf6 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-18 - **Author**: Mauricio Velazco, Splunk - **ID**: b0b34e2c-90de-11ec-baeb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `disabled_kerberos_pre-authentication_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators or power users may use PowerView for troubleshooting #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md index 19ebe9b103..e73ee7ac5f 100644 --- a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-18 - **Author**: Mauricio Velazco, Splunk - **ID**: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1021.006](https://attack.mitre.org/techniques/T1021/006/) | Windows Remote Management | Lateral Movement | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `interactive_session_on_remote_endpoint_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **interactive_session_on_remote_endpoint_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -131,7 +144,7 @@ Administrators may leverage WinRM and `Enter-PSSession` for administrative and t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 30570ba8b7..5a1d767dda 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -31,18 +31,19 @@ This search is to detect modification of registry to bypass UAC windows feature. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras, Splunk - **ID**: 0252ca80-e30d-11eb-8aa3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -50,37 +51,49 @@ This search is to detect modification of registry to bypass UAC windows feature. | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This search is to detect modification of registry to bypass UAC windows feature. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `net_profiler_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -135,7 +148,7 @@ limited false positive. It may trigger by some windows update that will modify t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index f6ef2b1d29..e8f0f99335 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -26,53 +26,66 @@ This search detects when an excessive number of authentication failures occur th - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-18 - **Author**: Rod Soto, Splunk - **ID**: d441364c-349c-453b-b55f-12eccab67cf9 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -88,10 +101,10 @@ This search detects when an excessive number of authentication failures occur th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `o365_excessive_authentication_failures_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **o365_excessive_authentication_failures_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ The threshold for alert is above 10 attempts and this should reduce the number o #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index 152595dc5c..3eeb6d0ab4 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -27,53 +27,66 @@ This detection is to identify a suspicious process that tries to delete the proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras - **ID**: f7eda4bc-871c-11eb-b110-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This detection is to identify a suspicious process that tries to delete the proc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `process_deleting_its_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * EventCode @@ -138,7 +151,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index d88e362c50..640a455271 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -30,17 +30,18 @@ This search is to detect a suspicious rundll32.exe process having a http connect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras, Splunk - **ID**: f1483f5e-ee29-11eb-9d23-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,37 +49,49 @@ This search is to detect a suspicious rundll32.exe process having a http connect | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -93,10 +106,10 @@ This search is to detect a suspicious rundll32.exe process having a http connect #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_dnsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -134,7 +147,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index 1ed8a9a274..e2c3712343 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -29,18 +29,19 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-18 - **Author**: Patrick Bareiss, Splunk - **ID**: c2590137-0b08-4985-9ec5-6ae23d92f63d -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | +
Kill Chain Phase +
+ * Installation * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 8 +
CVE +
+
#### Search @@ -100,10 +113,10 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Administrators may attempt to change the default execution policy on a system fo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 5debae51ed..a6023ab62f 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 114c6bfe-9406-11ec-bcce-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -132,7 +145,7 @@ Administrators or power users may use search for accounts with Kerberos Pre Auth #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md index 2492fa9409..10185d2ffd 100644 --- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md +++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md @@ -29,17 +29,18 @@ The following analytic leverages Windows Security Event 4738, `A user account wa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 0cb847ee-9423-11ec-b2df-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic leverages Windows Security Event 4738, `A user account wa | [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -92,7 +105,7 @@ The following analytic leverages Windows Security Event 4738, `A user account wa The SPL above uses the following Macros: * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) -Note that `kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kerberos_pre-authentication_flag_disabled_in_useraccountcontrol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -130,7 +143,7 @@ Unknown. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index 55015c2aec..f7b8fe52f7 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -33,18 +33,19 @@ The following analytic identifies the creation or deletion of a scheduled task u - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-22 - **Author**: Bhavin Patel, Splunk - **ID**: d5af132c-7c17-439c-9d31-13d55340f36c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,41 +53,53 @@ The following analytic identifies the creation or deletion of a scheduled task u | [T1053](https://attack.mitre.org/techniques/T1053/) | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.IP +
CIS20 +
+ * CIS 3 +
CVE +
+
#### Search @@ -102,10 +115,10 @@ The following analytic identifies the creation or deletion of a scheduled task u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `scheduled_task_deleted_or_created_via_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index 4e42344581..f0cd00e8be 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -27,59 +27,72 @@ This analytic is to look for wmi commandlines to execute or create process. This - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 0661c2de-93de-11ec-9833-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -95,11 +108,11 @@ This analytic is to look for wmi commandlines to execute or create process. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_wmi_process_call_create_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -144,7 +157,7 @@ Administrators may execute this command for testing or auditing. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md index f2eb58af2e..42e2822799 100644 --- a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -29,17 +29,18 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 59b51620-94c9-11ec-b3d5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,37 +48,49 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) | [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) -Note that `kerberos_pre-authentication_flag_disabled_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **kerberos_pre-authentication_flag_disabled_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Although unlikely, Administrators may need to set this flag for legitimate purpo #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md index b9c5cd913e..89c3ce9f75 100644 --- a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md @@ -30,17 +30,18 @@ This analytic will identify suspicious system event of services that was modifie - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c2620a8-94a1-11ec-b40c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic will identify suspicious system event of services that was modifie | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_event_for_service_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Windows service update may cause this event. In that scenario, filtering is need #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index ee3d935f32..2b50b29d1e 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -30,17 +30,18 @@ This analytic will identify suspicious excessive number of system events of serv - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: c3f85976-94a5-11ec-9a58-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic will identify suspicious excessive number of system events of serv | [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The SPL above uses the following Macros: * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_excessive_disabled_services_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ Unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index e9b7431aeb..55982e231d 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -28,59 +28,72 @@ This analytic is to look for process commandline that contains named pipe. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: e64399d4-94a8-11ec-a9da-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -96,10 +109,10 @@ This analytic is to look for process commandline that contains named pipe. This #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_process_with_namedpipe_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ Normal browser application may use this technique. Please update the filter macr #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md index e80191ca7f..0878a3ca08 100644 --- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md +++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md @@ -29,59 +29,72 @@ This analytic is to look for suspicious modification or creation of registry to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 25212358-948e-11ec-ad47-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1574.011](https://attack.mitre.org/techniques/T1574/011/) | Services Registry Permissions Weakness | Defense Evasion, Persistence, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -104,7 +117,7 @@ This analytic is to look for suspicious modification or creation of registry to The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_service_creation_using_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_service_creation_using_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Third party tools may used this technique to create services but not so common. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md index 107474bf64..3b772c1128 100644 --- a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md +++ b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md @@ -26,59 +26,72 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-02-24 - **Author**: Bhavin Patel, Splunk - **ID**: 211b80d3-6340-4345-11ad-212bf3d0d111 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1204](https://attack.mitre.org/techniques/T1204/) | User Execution | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -93,7 +106,7 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) -Note that `aws_lambda_updatefunctioncode_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_lambda_updatefunctioncode_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -129,7 +142,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md index 3141ce46f9..7efa22f149 100644 --- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md +++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md @@ -27,59 +27,72 @@ The following analytic identifies a process that is attempting to disable the ab - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-25 - **Author**: Michael Haag, Splunk - **ID**: 59e54602-9680-11ec-a8a6-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -100,7 +113,7 @@ The following analytic identifies a process that is attempting to disable the ab The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_memory_crash_dump_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_memory_crash_dump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index 981faad44a..4920f10377 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -27,59 +27,72 @@ This analytic is to look for suspicious file creation in the critical folder lik - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-25 - **Author**: Teoderick Contreras, Bhavin Patel, Splunk - **ID**: 0dbcac64-963c-11ec-bf04-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1485](https://attack.mitre.org/techniques/T1485/) | Data Destruction | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ This analytic is to look for suspicious file creation in the critical folder lik #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_file_without_extension_in_critical_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ Unknown at this point #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index 7f01cd69cd..4df2b62274 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -30,17 +30,18 @@ This analytic is to look for suspicious raw access read to device disk partition - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-02-25 - **Author**: Teoderick Contreras, Splunk - **ID**: a85aa37e-9647-11ec-90c5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ This analytic is to look for suspicious raw access read to device disk partition | [T1561](https://attack.mitre.org/techniques/T1561/) | Disk Wipe | Impact | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -99,10 +112,10 @@ This analytic is to look for suspicious raw access read to device disk partition #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_raw_access_to_disk_volume_partition_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -142,7 +155,7 @@ This event is really notable but we found minimal number of normal application f #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md index bfd9ffbfb6..b6fd1bc350 100644 --- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -26,54 +26,67 @@ This analytic will identify suspicious series of process executions. We have ob - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) - **Last Updated**: 2022-02-28 - **Author**: Michael Hart, Mauricio Velazco, Splunk - **ID**: 23587b6a-c479-11eb-b671-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -90,10 +103,10 @@ This analytic will identify suspicious series of process executions. We have ob #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `excessive_distinct_processes_from_windows_temp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -128,7 +141,7 @@ Many benign applications will create processes from executables in Windows\Temp, #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md index d60965c929..bab888e394 100644 --- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md +++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md @@ -27,59 +27,72 @@ This analytic is to look for suspicious registry modification related to file co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-02 - **Author**: Teoderick Contreras, Splunk - **ID**: b7548c2e-9a10-11ec-99e3-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to look for suspicious registry modification related to file co The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_modify_show_compress_color_and_info_tip_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_modify_show_compress_color_and_info_tip_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index 823f2e1492..6dd7347cd5 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-03-03 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0d111 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events where a user A who has already permi | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_createaccesskey_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index 45a882fa35..ecbe2fa65c 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -29,17 +29,18 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - - **Last Updated**: 2022-03-03 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6a40-4115-11ad-212bf3d0d111 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -47,43 +48,55 @@ This search looks for AWS CloudTrail events where a user A who has already permi | [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.DS * PR.AC * DE.CM +
CIS20 +
+ * CIS 13 +
CVE +
+
#### Search @@ -103,7 +116,7 @@ The SPL above uses the following Macros: * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `aws_updateloginprofile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -140,7 +153,7 @@ While this search has no known false positives, it is possible that an AWS admin #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md index d2084bd54e..3d61e4171d 100644 --- a/docs/_posts/2022-03-04-macos_lolbin.md +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -30,17 +30,18 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-04 - **Author**: Patrick Bareiss, Splunk - **ID**: 58d270fb-5b39-418e-a855-4b8ac046805e -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,43 +49,55 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -101,10 +114,10 @@ Detect multiple executions of Living off the Land (LOLbin) binaries in a short p #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `macos_lolbin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **macos_lolbin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -143,7 +156,7 @@ None identified. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md index 313cd50bec..4942fa4fe4 100644 --- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md +++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md @@ -35,18 +35,19 @@ The following analytic identifies msbuild.exe executing from a non-standard path - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-08 - **Author**: Michael Haag, Splunk - **ID**: f5198224-551c-11eb-ae93-0242ac130002 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -58,42 +59,54 @@ The following analytic identifies msbuild.exe executing from a non-standard path | [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -109,11 +122,11 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_msbuild_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -160,7 +173,7 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md index 93b279df50..09a1831a20 100644 --- a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to disable change - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: 0df33e1a-9ef6-11ec-a1ad-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable change The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_change_password_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_change_password_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ This windows feature may implemented by administrator to prevent normal user to #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md index daa7a11051..492a4d9c27 100644 --- a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to disable Lock Co - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: c82adbc6-9f00-11ec-a81f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable Lock Co The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_lock_workstation_feature_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_lock_workstation_feature_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md index 03c05d463b..79bdf8a03d 100644 --- a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to disable logoff - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: b2fb6830-9ed1-11ec-9fcb-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable logoff The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_logoff_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_logoff_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -147,7 +160,7 @@ This windows feature may implement by administrator in some server where shutdow #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md index 0bf4af8a73..5c1343c988 100644 --- a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to disable shutdow - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: 55fb2958-9ecd-11ec-a06a-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable shutdow The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_shutdown_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_shutdown_button_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -145,7 +158,7 @@ This windows feature may implement by administrator in some server where shutdow #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md index 05384c0fc5..96950db01e 100644 --- a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to disable windows - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: 63a449ae-9f04-11ec-945e-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to disable windows The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_disable_windows_group_policy_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_disable_windows_group_policy_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -148,7 +161,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md index 47c96f1234..597b972b25 100644 --- a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md +++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md @@ -27,59 +27,72 @@ This analytic is to detect a suspicious registry modification to hide common win - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-08 - **Author**: Teoderick Contreras, Splunk - **ID**: cafa4bce-9f06-11ec-a7b2-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ * DE.CM +
CIS20 +
+ * CIS 3 * CIS 5 * CIS 16 +
CVE +
+
#### Search @@ -102,7 +115,7 @@ This analytic is to detect a suspicious registry modification to hide common win The SPL above uses the following Macros: * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `windows_hide_notification_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_hide_notification_features_through_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -146,7 +159,7 @@ unknown #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md index 0e6994e970..190d61e635 100644 --- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -29,18 +29,19 @@ The following analytic identifies regasm.exe with no command line arguments. Thi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: c3bc1430-04e7-4178-835f-047d8e6e97df -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies regasm.exe with no command line arguments. Thi | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,11 +113,11 @@ The following analytic identifies regasm.exe with no command line arguments. Thi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regasm_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Although unlikely, limited instances of regasm.exe or may cause a false positive #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md index c860e7e822..866a54fdb2 100644 --- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -29,18 +29,19 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -48,42 +49,54 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th | [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
+
#### Search @@ -100,11 +113,11 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `detect_regsvcs_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -150,7 +163,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md index a0ff54094d..772ed5f046 100644 --- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -28,53 +28,66 @@ The following analytic identifies DLLHost.exe with no command line arguments wit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: f1c07594-a141-11eb-8407-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies DLLHost.exe with no command line arguments wit #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `dllhost_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Although unlikely, some legitimate third party applications may use a moved copy #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md index 95baf4b9fb..dac22000fe 100644 --- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -28,53 +28,66 @@ The following analytic identifies gpupdate.exe with no command line arguments an - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: 2c853856-a140-11eb-a5b5-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies gpupdate.exe with no command line arguments an #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `gpupdate_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -138,7 +151,7 @@ Limited false positives may be present in small environments. Tuning may be requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md index d37c5492c8..c2ad89a4c9 100644 --- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -30,18 +30,19 @@ The following analytic identifies rundll32.exe with no command line arguments an - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: 35307032-a12d-11eb-835f-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,41 +50,53 @@ The following analytic identifies rundll32.exe with no command line arguments an | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -106,10 +119,10 @@ The following analytic identifies rundll32.exe with no command line arguments an #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `rundll32_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,7 +170,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md index b8bf49270f..f31630945d 100644 --- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -28,53 +28,66 @@ The following analytic identifies searchprotocolhost.exe with no command line ar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: b690df8c-a145-11eb-a38b-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -96,10 +109,10 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `searchprotocolhost_with_no_command_line_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -136,7 +149,7 @@ Limited false positives may be present in small environments. Tuning may be requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md index 186a363cf9..6de2577630 100644 --- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -27,54 +27,67 @@ The following analytic identifies DLLHost.exe with no command line arguments. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: ff61e98c-0337-4593-a78f-72a676c56f26 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,11 +104,11 @@ The following analytic identifies DLLHost.exe with no command line arguments. It #### Macros The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -Note that `suspicious_dllhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Limited false positives may be present in small environments. Tuning may be requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md index df2c5e8965..0b1c616369 100644 --- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -27,54 +27,67 @@ The following analytic identifies gpupdate.exe with no command line arguments. I - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: f308490a-473a-40ef-ae64-dd7a6eba284a -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,11 +104,11 @@ The following analytic identifies gpupdate.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_gpupdate_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -139,7 +152,7 @@ Limited false positives may be present in small environments. Tuning may be requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md index df88b5fdc8..94299762a1 100644 --- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -30,18 +30,19 @@ The following analytic identifies rundll32.exe with no command line arguments. I - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -49,46 +50,58 @@ The following analytic identifies rundll32.exe with no command line arguments. I | [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | +
Kill Chain Phase +
+ * Actions on Objectives +
NIST +
+ * PR.PT * DE.CM +
CIS20 +
+ * CIS 8 +
CVE +
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | | ----------- | ----------- | -------------- | | [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | +
#### Search @@ -106,10 +119,10 @@ The following analytic identifies rundll32.exe with no command line arguments. I #### Macros The SPL above uses the following Macros: * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_rundll32_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -157,7 +170,7 @@ Although unlikely, some legitimate applications may use a moved copy of rundll32 #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md index 0741141c43..986cc33ef5 100644 --- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -27,54 +27,67 @@ The following analytic identifies searchprotocolhost.exe with no command line ar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-03-15 - **Author**: Michael Haag, Splunk - **ID**: f52d2db8-31f9-4aa7-a176-25779effe55c -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | | [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -91,10 +104,10 @@ The following analytic identifies searchprotocolhost.exe with no command line ar #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `suspicious_searchprotocolhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -137,7 +150,7 @@ Limited false positives may be present in small environments. Tuning may be requ #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md index fca625b4b4..6ba3466b6c 100644 --- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -33,17 +33,18 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-16 - **Author**: Michael Haag, Splunk - **ID**: 4fbf9270-43da-11ec-9486-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -51,37 +52,49 @@ During triage review resulting network connections, file modifications, and para | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -102,11 +115,11 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_remote_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -153,7 +166,7 @@ Limited false positives should be present as InstallUtil is not typically used t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md index 6034c27974..167481cd52 100644 --- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -34,17 +34,18 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) - - **Last Updated**: 2022-03-16 - **Author**: Michael Haag, Splunk - **ID**: 1a52c836-43ef-11ec-a36c-acde48001122 -#### Metadata +#### Annotations
ATT&CK +
+ | ID | Technique | Tactic | | -------------- | ---------------- |-------------------- | @@ -52,37 +53,49 @@ During triage review resulting network connections, file modifications, and para | [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | +
Kill Chain Phase +
+ * Exploitation +
NIST +
+ +
CIS20 +
+ +
CVE +
+
#### Search @@ -103,11 +116,11 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -Note that `windows_installutil_uninstall_option_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. +Note that **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. #### Required field * _time @@ -156,7 +169,7 @@ Limited false positives should be present as InstallUtil is not typically used t #### Test Dataset -Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) diff --git a/docs/index.markdown b/docs/index.markdown index bcabeb2798..c3438b6133 100644 --- a/docs/index.markdown +++ b/docs/index.markdown @@ -28,14 +28,31 @@ feature_row: - image_path: /static/feature_playbooks.png alt: "100% free" title: "Playbooks" - excerpt: "See all **31** automated investigation 🔭 and response 🛠 playbooks " + excerpt: "See all **31** automated investigation 🔭 and response 🛠 playbooks." url: "/playbooks" btn_class: "btn--primary" btn_label: "Explore" +feature_row2: + - image_path: /static/feature_detection.png + alt: "customizable" + title: "Security Content Repository" + excerpt: "Look under 🚙 the hood ." + url: "https://github.com/splunk/security_content" + - image_path: /static/attack_range.png + alt: "fully responsive" + title: "Attack Range" + excerpt: "🪛 to create a isolated environment to launch attacks and test/build detections." + url: "https://github.com/splunk/attack_range/" + - image_path: /static/feature_playbooks.png + alt: "100% free" + title: "Attack Data" + excerpt: "A catalog 📑 of attack data sets in their raw form." + url: "https://github.com/splunk/attack_data/" --- {% include feature_row %} +{% include feature_row id="feature_row2" %} # Welcome to Splunk Security Content @@ -48,29 +65,6 @@ Below is a snapshot in time of what technique we currently have some detection c [![](mitre-map/coverage.png)](https://mitremap.splunkresearch.com/) -## View Our Content 🔎 - -* [Analytic Stories](/stories) -* [Detections](/detections) -* [Playbooks](/playbooks) - -If you prefer working with the command line, check out our [API](https://docs.splunkresearch.com/?version=latest): - -``` -curl -s https://content.splunkresearch.com | jq -{ - "hello": "welcome to Splunks Research security content api" -} -``` - -## Test Out The Detections 🏗 - -Replay any detection dataset to a Splunk Enterprise Server by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). Alternatively use: - -![](static/attack_range.png) - -The [Splunk Attack Range](https://github.com/splunk/attack_range) which allows you to create a isolated environment to launch attacks and test/build detections. - ## Questions? 📞 Please use the [GitHub issue tracker](https://github.com/splunk/attack_range/issues) to submit bugs or request features.