admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #72 from splunk/title_fix

Browse Source 
src files
This commit is contained in:
Bhavin Patel
2019-05-10 13:28:48 -07:00
committed by GitHub
parent 4fc1963103 58fcd303b3
commit ea9ff93302
3 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/default/analytic_stories.conf
+7 -7
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2019-05-10T19:52:25 UTC
# On Date: 2019-05-10T20:27:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -249,7 +249,7 @@ reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searc
detection_searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule"]
mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
investigative_searches = ["ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["AWS", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
@@ -305,7 +305,7 @@ reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule"]
mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Email", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
@@ -425,7 +425,7 @@ reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule"]
mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Email", "Endpoint", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
@@ -445,7 +445,7 @@ reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-
detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule"]
mappings = {"mitre_attack": [], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Email", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -781,7 +781,7 @@ reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced
detection_searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
@@ -797,7 +797,7 @@ reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wa
detection_searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule"]
mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
data_models = ["Authentication", "Endpoint", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
src/default/savedsearches.conf
+3 -3
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2019-05-10T19:52:25 UTC
# On Date: 2019-05-10T20:27:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -9873,11 +9873,11 @@ schedule_window = auto
is_visible = false
search = | tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel
[ESCU - Model Builder For SMB Traffic Spike - MLTK]
[ESCU - Model Builder For SMB Traffic Spike MLTK]
action.escu = 0
action.escu.enabled = 1
action.escu.search_type = support
action.escu.full_search_name = ESCU - Model Builder For SMB Traffic Spike - MLTK
action.escu.full_search_name = ESCU - Model Builder For SMB Traffic Spike MLTK
description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.
action.escu.creation_date = 2019-05-08
action.escu.modification_date = 2019-05-08
src/default/use_case_library.conf
+8 -8
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2019-05-10T19:52:25 UTC
# On Date: 2019-05-10T20:27:53 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -191,7 +191,7 @@ version = 1.0
references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
\
@@ -232,7 +232,7 @@ version = 2.0
references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \
\
@@ -322,7 +322,7 @@ version = 1.0
references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 1
searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \
\
@@ -337,7 +337,7 @@ version = 2.0
references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\
\
@@ -613,7 +613,7 @@ version = 1.0
references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.
@@ -624,7 +624,7 @@ version = 1.0
references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
spec_version = 1
searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
@@ -3275,7 +3275,7 @@ how_to_implement = To successfully implement this search, you will need to ensur
known_false_positives =
providing_technologies = ["Splunk Stream", "Bro"]
[savedsearch://ESCU - Model Builder For SMB Traffic Spike - MLTK]
[savedsearch://ESCU - Model Builder For SMB Traffic Spike MLTK]
type = support
explanation = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.
how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.