Branch was auto-updated.

bin/generate.py

@@ -104,8 +104,11 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
     # disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references
     yaml.Dumper.ignore_aliases = lambda *args : True
 
+    # wiping old detections for SSA
+    shutil.rmtree(OUTPUT_PATH + '/detections/*', ignore_errors=True)
+
     for d in detections:
-        manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
+        manifest_file = OUTPUT_PATH + '/detections/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
 
         # remove unused fields
         del d['risk']
@@ -113,6 +116,14 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
         del d['mappings']
         del d['savedsearch_annotations']
 
+        # add detection test
+        test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
+        for file in glob.glob('tests/*/*'):
+            if test_file == file.split("/")[-1]:
+                with open(file, 'r') as file:
+                    test_yaml = yaml.safe_load(file)
+                    d['test'] = test_yaml
+
         with open(manifest_file, 'w') as file:
             documents = yaml.dump(d, file, sort_keys=True)
 
@@ -414,7 +425,6 @@ def add_playbook(detection, playbooks):
             if detection['name'] in playbook['tags']['detections']:
                 detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
         except KeyError:
-            print("playbook " + playbook['name'] + " has no detections, passing....")
             pass
     return detection
 
@@ -664,6 +674,43 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     global global_product
     global_product = PRODUCT
 
+    TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
+
+    objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
+
+    try:
+        if VERBOSE:
+            print("generating Mitre lookups")
+    #    generate_mitre_lookup(OUTPUT_PATH)
+    except Exception as e:
+        print('Error: ' + str(e))
+        print("WARNING: Generation of Mitre lookup failed.")
+
+    # calculate deprecation totals
+    deprecated = []
+    for d in objects['detections']:
+        if 'deprecated' in d:
+            deprecated.append(d)
+
+    detection_path = ''
+    lookups_path = ''
+    lookups_files= ''
+    use_case_lib_path = ''
+    macros_path = ''
+    workbench_panels_objects = ''
+
+    if global_product == 'SSA':
+        detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        objects["macros"] = []
+    else:
+        detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
+        use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
+
     if global_product == 'API':
         json_types = []
         # List of all YAML types to search in repo
@@ -673,63 +720,25 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
         if VERBOSE: print("JSON output directory: " + output_dir)
         # remove any pre-existing output directories
         shutil.rmtree(output_dir, ignore_errors=True)
-        if VERBOSE: print("Remove pre-existing JSON directory")
+        if VERBOSE: print("remove pre-existing JSON directory")
         # create output directory
         os.mkdir(output_dir)
-        if VERBOSE: print("Created output directory")
+        if VERBOSE: print("created output directory")
         # Generate all YAML types
         for yt in yml_types:
             processor = Yaml2Json(yt, REPO_PATH)
             with open(os.path.join(output_dir, yt + '.json'), 'w') as json_out:
                 # write out YAML type
                 json.dump(processor.list_objects(yt), json_out)
-                if VERBOSE: print("Writing %s JSON" % yt)
+                if VERBOSE: print("writing {0} JSON".format(yt))
 
-    else:
-        TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
-
-        objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
-
-        try:
-            if VERBOSE:
-                print("generating Mitre lookups")
-        #    generate_mitre_lookup(OUTPUT_PATH)
-        except Exception as e:
-            print('Error: ' + str(e))
-            print("WARNING: Generation of Mitre lookup failed.")
-
-        # calculate deprecation totals
-        deprecated = []
-        for d in objects['detections']:
-            if 'deprecated' in d:
-                deprecated.append(d)
-
-        detection_path = ''
-        lookups_path = ''
-        lookups_files= ''
-        use_case_lib_path = ''
-        macros_path = ''
-        workbench_panels_objects = ''
-
-        if global_product == 'SSA':
-            detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            objects["macros"] = []
-        else:
-            detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
-            use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
-
-        if VERBOSE:
-            print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
-            print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
-            print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
-            print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
-            print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
-            print("security content generation completed..")
+    if VERBOSE:
+        print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
+        print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
+        print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
+        print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
+        print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
+        print("security content generation completed..")
 
 
 if __name__ == "__main__":

dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml

@@ -88,5 +88,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+    name: Applying Stolen Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml

@@ -92,5 +92,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+    name: Applying Stolen Credentials via PowerSploit
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___attempt_to_delete_services.yml

@@ -12,9 +12,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
-name: Attempt To Delete Services
+known_false_positives: unknown
+name: Attempt To delete Services
 product:
 - Splunk Behavioral Analytics
 references:
@@ -88,5 +87,16 @@ tags:
   risk_score: 36
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Attempt To delete Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
+      file_name: sc_del.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to delete a service
+    file: endpoint/ssa___attempt_to_delete_services.yml
+    name: Attempt To delete Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3

dist/ssa/detections/ssa___attempt_to_disable_services.yml

@@ -90,5 +90,16 @@ tags:
   risk_score: 36
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Attempt To Disable Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
+      file_name: sc_disable.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to disable a service
+    file: endpoint/ssa___attempt_to_disable_services.yml
+    name: Attempt To Disable Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3

dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -77,5 +77,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+    name: Attempted Credential Dump From Registry via Reg exe
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___delete_a_net_user.yml

@@ -92,5 +92,16 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Delete A Net User Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+      file_name: net_user_del.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to delete net user
+    file: endpoint/ssa___delete_a_net_user.yml
+    name: Delete A Net User
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 3

dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml

@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Deny Permission using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls deny permission to a file(s) or folder(s)
+    file: endpoint/ssa___deny_permission_using_cacls_utility.yml
+    name: Deny Permission using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml

@@ -76,5 +76,16 @@ tags:
   risk_score: 70
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+    name: Detect Dump LSASS Memory using comsvcs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___detect_kerberoasting.yml

@@ -79,5 +79,16 @@ tags:
   risk_score: 14
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Detect Kerberoasting - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test detection of kerberoasting
+    file: endpoint/ssa___detect_kerberoasting.yml
+    name: Detect kerberoasting
+    pass_condition: '@count_eq(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -1,7 +1,6 @@
 author: Ignacio Bermudez Corrales, Splunk
-datamodel:
-- Endpoint_Processes
-date: '2020-11-10'
+datamodel: []
+date: '2021-11-10'
 description: The following analytic identifies parent processes, browsers, Windows
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -22,7 +21,8 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -88,5 +88,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Detect Prohibited Applications Spawning cmd exe Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Detect Prohibited Applications Spawning cmd exe
+    file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+    name: Detect Prohibited Applications Spawning cmd exe
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 2

dist/ssa/detections/ssa___disable_net_user_account.yml

@@ -88,5 +88,16 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Disable Net User Account Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
+      file_name: net_user_dis.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to disable net user
+    file: endpoint/ssa___disable_net_user_account.yml
+    name: Disable Net User Account
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3

dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml

@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Grant Permission Using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls grant permission to a file(s) or folder(s)
+    file: endpoint/ssa___grant_permission_using_cacls_utility.yml
+    name: Grant Permission Using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml

@@ -75,5 +75,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Account Creation via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal account creation detections
+    file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+    name: Illegal Account Creation via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml

@@ -84,5 +84,17 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA
+    Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test privilege elevation and persistence detections
+    file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+    name: Illegal Privilege Elevation and Persistence via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml

@@ -79,5 +79,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal privilege elevation detections
+    file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+    name: Illegal Privilege Elevation via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml

@@ -81,5 +81,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+    name: Illegal Service and Process Control via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml

@@ -91,5 +91,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+    name: Illegal Service and Process Control via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -79,5 +79,17 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Modify ACLs Permission Of Files Or Folders Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for modifying permission of a file(s) or folder(s) using cacls
+      utility.
+    file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+    name: Modify ACLs Permission Of Files Or Folders
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1

dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

@@ -76,5 +76,17 @@ tags:
   risk_score: 60
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit
+    test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test access probing with stolen credentials detections
+    file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+    name: Probing Access with Stolen Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___resize_shadowstorage_volume.yml

@@ -92,5 +92,16 @@ tags:
   risk_score: 64
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Resize Shadowstorage Volume Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test for resizing the shadow storage of a machine
+    file: endpoint/ssa___resize_shadowstorage_volume.yml
+    name: Resize Shadowstorage Volume
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___sdelete_application_execution.yml

@@ -0,0 +1,105 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-11-15'
+description: This analytic will detect the execution of sdelete.exe attempting to
+  delete potentially important files that may related to adversary or insider threats
+  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
+  to securely delete files on disk. This tool is commonly used to clear tracks and
+  artifact on the targeted host.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: fcc52b9a-4616-11ec-8454-acde48001122
+known_false_positives: False positives should be limited, filter as needed.
+name: Sdelete Application Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
+risk_message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+  delete files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
+  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
+  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
+  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
+  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
+  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
+  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
+  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
+  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
+  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
+  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
+  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
+  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Information Sabotage
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+    delete files.
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
+  observable:
+  - name: dest
+    role:
+    - Victim
+    type: Endpoint
+  - name: user
+    role:
+    - Victim
+    type: User
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest
+  - user
+  - parent_process_name
+  - parent_process
+  - process_name
+  - process
+  - process_id
+  - process_path
+  risk_score: 42
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Sdelete Application Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test for sdelete execution command
+    file: endpoint/ssa___sdelete_application_execution.yml
+    name: Sdelete Application Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1

dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml

@@ -88,5 +88,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via DSInternals modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+      file_name: logAllDSInternalsModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+    name: Setting Credentials via DSInternals modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml

@@ -78,5 +78,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+    name: Setting Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml

@@ -78,5 +78,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+    name: Setting Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1

dist/ssa/detections/ssa___unusually_long_command_line.yml

@@ -72,5 +72,16 @@ tags:
   risk_score: 12
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Unusually Long Command Line - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test unusually long command lines
+    file: endpoint/ssa___unusually_long_command_line.yml
+    name: Unusually Long Command Line
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1

dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml

@@ -82,5 +82,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: WevtUtil Usage To Clear Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+      file_name: clear_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil clear logs command
+    file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+    name: WevtUtil Usage To Clear Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2

dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml

@@ -78,5 +78,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Wevtutil Usage To Disable Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+      file_name: disable_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil disable logs command
+    file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+    name: Wevtutil Usage To Disable Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2