admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-04-05 13:12:38 -07:00
committed by GitHub
parent 901a73aa5f 0f0bac3789
commit ec2c1bff73
899 changed files with 51757 additions and 10613 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/detection-testing.yml
+33 -1
View File
@@ -287,8 +287,8 @@ jobs:
name: DetectionFailureManifest
path: |
bin/docker_detection_tester/detection_failure_manifest.json
#Always clean these up, they make the output messy
- name: Clean up intermediate Files
uses: geekyeggo/delete-artifact@v1
@@ -305,7 +305,39 @@ jobs:
config_tests_7.json.results
config_tests_8.json.results
config_tests_9.json.results
- name: Log in to S3 for Artifact Uploads
if: ${{ github.event_name == 'schedule' }}
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: Upload S3 Badge and Summary Artifacts for Nightly Scheduled Run
if: ${{ github.event_name == 'schedule' }}
run: |
cd bin/docker_detection_tester
python generate_detection_coverage_badge.py --input_summary_file summary_test_results.json --output_badge_file detection_coverage.svg --badge_string "Pass Rate"
#Upload artifact (summary test results)
aws s3 cp summary_test_results.json s3://security-content/reporting/summary_test_results.json
#Since these reside in a public bucket, no need to explicitly mark as public
# make the file public since it is not by default
#aws s3api put-object-acl --bucket security-content --key reporting/summary_test_results.json --acl public-read
#Upload artifact (test results coverage badge)
aws s3 cp detection_coverage.svg s3://security-content/reporting/detection_coverage.svg
#Since these reside in a public bucket, no need to explicitly mark as public
# make the file public since it is not by default
#aws s3api put-object-acl --bucket security-content --key reporting/detection_coverage.svg --acl public-read
README.md
+1
View File
@@ -129,3 +129,4 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detection_page.j2
+2 -2
View File
@@ -12,8 +12,8 @@ sidebar:
| -------------- | --------------- | --------------- |
{%- for detection in objects -%}
{% if detection.tags.mitre_attack_enrichments %}
| [{{ detection.name }}](/{{ detection.source }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.tags.mitre_attack_enrichments -%} [{{ attack.mitre_attack_technique }}](/tags/#{{ attack.mitre_attack_technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} |
| [{{ detection.name }}](/{{ detection.source }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.tags.mitre_attack_enrichments -%} [{{ attack.mitre_attack_technique }}](/tags/#{{ attack.mitre_attack_technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
{%- else %}
| [{{ detection.name }}]() | None | {{ detection.type }} |
| [{{ detection.name }}]() | None | [{{ detection.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
{%- endif -%}
{%- endfor -%}
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2
+73 -21
View File
@@ -44,17 +44,23 @@ We have not been able to test, simulate, or build datasets for this object. Use
{{ object.description }}
- **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: {{ object.tags.product|join(', ') }}
{% if object.datamodel -%}- **Datamodel**: {% for datamodel in object.datamodel %}[{{ datamodel }}](https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
{% if object.splunk_app_enrichment -%}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
{%- if object.splunk_app_enrichment %}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
- **Last Updated**: {{ object.date }}
- **Author**: {{object.author}}
- **ID**: {{ object.id }}
{% if object.tags.mitre_attack_id %}
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
{% if object.tags.mitre_attack_id %}
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
{%- for attack in object.tags.mitre_attack_enrichments %}
@@ -68,6 +74,66 @@ We have not been able to test, simulate, or build datasets for this object. Use
{% endfor %}
{% endif -%}
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
{% for phase in object.annotations.kill_chain_phases -%}
* {{ phase }}
{% endfor %}
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
{% if object.annotations.nist -%}
{% for nist in object.annotations.nist -%}
* {{ nist }}
{% endfor %}
{% endif %}
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
{% if object.annotations.cis20 -%}
{% for cis in object.annotations.cis20 -%}
* {{ cis }}
{% endfor %}
{% endif %}
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
{% if object.cve_enrichment -%}
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
{% for cve in object.cve_enrichment -%}
| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
{% endfor %}
{% endif %}
</div>
</details>
#### Search
```
@@ -84,7 +150,7 @@ The SPL above uses the following Macros:
{% endfor %}
{% endif -%}
Note that `{{object.name | lower | replace(" ", "_") }}_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **{{object.name | lower | replace(" ", "_") }}_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
{% if object.lookups -%}
#### Lookups
@@ -111,10 +177,6 @@ The SPL above uses the following Lookups:
* [{{ story }}](/stories/{{story|lower|replace(" ", "_")}})
{% endfor %}
#### Kill Chain Phase
{% for phase in object.tags.kill_chain_phases -%}
* {{ phase }}
{% endfor %}
{% if object.tags.observable %}
#### RBA
@@ -124,16 +186,6 @@ The SPL above uses the following Lookups:
| {{(object.tags.impact * object.tags.confidence)/100}} | {{ object.tags.impact }} | {{ object.tags.confidence }} | {{object.tags.message}} |
{% endif %}
{% if object.cve_enrichment -%}
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
{% for cve in object.cve_enrichment -%}
| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
{% endfor %}
{% endif %}
#### Reference
{% if object.references %}
{% for reference in object.references -%}
@@ -142,7 +194,7 @@ The SPL above uses the following Lookups:
{% endif %}
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
{% if object.tags.dataset %}
@@ -151,4 +203,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
{% endfor %}
{% endif %}
[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{object.version}}**
[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{object.version}}**
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2
+3 -3
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
@@ -45,4 +45,4 @@ playbooks:
- title: "Response"
url: /tags/#response/
- title: "Investigation"
url: /tags/#investigation/
url: /tags/#investigation/
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/detections.md
+2 -2
View File
@@ -10,5 +10,5 @@ sidebar:
| Name | Technique | Type |
| -------------- | --------------- | --------------- |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -59,7 +114,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +132,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +141,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 90.0 | 90 | 100 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+62 -11
View File
@@ -27,16 +27,21 @@ tags:
Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +114,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ None identified.
* [DarkSide Ransomware](/stories/darkside_ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -98,8 +151,6 @@ None identified.
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
@@ -107,7 +158,7 @@ None identified.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_pages/detections.md
+2 -2
View File
@@ -10,5 +10,5 @@ sidebar:
| Name | Technique | Type |
| -------------- | --------------- | --------------- |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -59,7 +114,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +132,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +141,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 90.0 | 90 | 100 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+62 -11
View File
@@ -27,16 +27,21 @@ tags:
Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +114,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ None identified.
* [DarkSide Ransomware](/stories/darkside_ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -98,8 +151,6 @@ None identified.
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
@@ -107,7 +158,7 @@ None identified.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/docker_detection_tester/generate_detection_coverage_badge.py
+65
View File
@@ -0,0 +1,65 @@
import argparse
import json
import sys
RAW_BADGE_SVG = '''<?xml version="1.0"?>
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="20">
<linearGradient id="a" x2="0" y2="100%">
<stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
<stop offset="2" stop-opacity=".1"/>
</linearGradient>
<rect rx="3" width="60" height="20" fill="#555"/> <!-- Comment -->
<rect rx="3" x="60" width="40" height="20" fill="#4c1"/>
<path fill="#4c1" d="M58 0h4v20h-4z"/>
<rect rx="3" width="100" height="20" fill="url(#a)"/>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="30" y="14">{}</text>
<text x="80" y="14">{}</text>
</g>
</svg>'''
parser = argparse.ArgumentParser(description='Use a summary.json file to generate a test coverage badge')
parser.add_argument('-i', "--input_summary_file", type=argparse.FileType('r'), required = True,
help='Summary file to use to generate the pass percentage badge')
parser.add_argument('-o', "--output_badge_file", type=argparse.FileType('w'), required = True,
help='Name of the badge to output')
parser.add_argument('-s', "--badge_string", type=str, required = True,
help='Name of the badge to output')
try:
results = parser.parse_args()
except Exception as e:
print(f"Error parsing arguments: {str(e)}")
exit(1)
try:
summary_info = json.loads(results.input_summary_file.read())
except Exception as e:
print(f"Error loading {results.input_summary_file.name} JSON file: {str(e)}")
sys.exit(1)
if 'summary' not in summary_info:
print("Missing 'summary' key in {results.input_summary_file.name}")
sys.exit(1)
elif 'PASS_RATE' not in summary_info['summary'] or 'TESTS_PASSED' not in summary_info['summary']:
print(f"Missing PASS_RATE in 'summary' section of {results.input_summary_file.name}")
sys.exit(1)
pass_percent = 100 * summary_info['summary']['PASS_RATE']
try:
results.output_badge_file.write(RAW_BADGE_SVG.format(results.badge_string, "{:2.1f}%".format(pass_percent)))
except Exception as e:
print(f"Error generating badge: {str(e)}")
sys.exit(1)
print(f"Badge {results.output_badge_file.name} successfully generated!")
sys.exit(0)
detections/cloud/github_actions_disable_security_workflow.yml
+72
View File
@@ -0,0 +1,72 @@
name: GitHub Actions Disable Security Workflow
id: 0459f1a5-c0ac-4987-82d6-65081209f854
version: 1
date: '2022-04-04'
author: Patrick Bareiss, Splunk
type: Anomaly
datamodel: []
description: This search detects a disabled security workflow in GitHub Actions.
An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
search: '`github` workflow_run.event=push OR workflow_run.event=pull_request
| stats values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event workflow_run.head_branch workflow_run.head_commit.author.email
workflow_run.head_commit.author.name workflow_run.head_commit.message workflow_run.head_commit.timestamp
workflow_run.head_repository.full_name workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login
workflow_run.head_repository.owner.type
| rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email as user_email, workflow_run.head_repository.full_name as repository,
workflow_run.head_branch as branch
| search NOT workflow_run.name=*security-testing*
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `github_actions_disable_security_workflow_filter`'
how_to_implement: You must index GitHub logs. You can follow the url in reference
to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf.
Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
known_false_positives: unknown
references:
- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
tags:
analytic_story:
- Dev Sec Ops
asset_type: GitHub
cis20:
- CIS 13
confidence: 90
context:
- Source:Application Log
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log
impact: 30
kill_chain_phases:
- Actions on Objectives
message: Security Workflow is disabled in branch $branch$ for repository $repository$
mitre_attack_id:
- T1195.002
- T1195
nist:
- PR.DS
- PR.AC
- DE.CM
observable:
- name: repository
type: Unknown
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- workflow_run.event
- workflow_run.name
- workflow_run.head_commit.id
- workflow_run.event workflow_run.head_branch
- workflow_run.head_commit.author.email
- workflow_run.head_commit.author.name
- workflow_run.head_commit.message
- workflow_run.head_commit.timestamp
- workflow_run.head_repository.full_name
- workflow_run.head_repository.owner.id
- workflow_run.head_repository.owner.login
- workflow_run.head_repository.owner.type
risk_score: 27
security_domain: network
detections/cloud/github_commit_changes_in_master.yml
+5 -5
View File
@@ -10,11 +10,11 @@ description: This search is to detect a pushed or commit to master or main branc
Ideally in terms of devsecops the changes made in a branch and do a PR for review.
of course in some cases admin of the project may did a changes directly to master
branch
search: '`github` branches{}.name = main OR branches{}.name = master | eval severity="low"
| eval phase="code" | stats count min(_time) as firstTime max(_time) as lastTime by
commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message
repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code"
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
search: '`github` branches{}.name = main OR branches{}.name = master
| stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message
repository.pushed_at commit.commit.committer.date repository.full_name
| rename commit.author.login as user, repository.full_name as repository
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs related to github logs having the fork, commit, push metadata that can be use
to monitor the changes in a github project.
detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+65
View File
@@ -0,0 +1,65 @@
name: Kerberos Service Ticket Request Using RC4 Encryption
id: 7d90f334-a482-11ec-908c-acde48001122
version: 1
date: '2022-03-15'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic leverages Kerberos Event 4769, A Kerberos service
ticket was requested, to identify a potential Kerberos Service Ticket request related to a Golden Ticket attack. Adversaries who have obtained the Krbtgt account NTLM password
hash may forge a Kerberos Granting Ticket (TGT) to obtain unrestricted access to an Active Directory environment. Armed with a Golden Ticket, attackers can request
service tickets to move laterally and execute code on remote systems. Looking for Kerberos Service Ticket requests using the legacy RC4 encryption mechanism could represent the second stage
of a Golden Ticket attack. RC4 usage should be rare on a modern network since Windows Vista & Windows Sever 2008 and newer support AES Kerberos encryption.\
Defenders should note that if an attacker does not leverage the NTLM password hash but rather the AES key to create a golden ticket, this detection may be bypassed.
search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" (Ticket_Options=0x40810000
OR Ticket_Options=0x40800000 OR Ticket_Options=0x40810010) Ticket_Encryption_Type=0x17
| stats count min(_time) as firstTime max(_time) as lastTime by dest, service, service_id,
Ticket_Encryption_Type, Ticket_Options | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
| `kerberos_service_ticket_request_using_rc4_encryption_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for Kerberos Service Ticket requests. Specifically,
systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
references:
- https://attack.mitre.org/techniques/T1558/001/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
- https://adsecurity.org/?p=1515
- https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
- https://en.hackndo.com/kerberos-silver-golden-tickets/
tags:
analytic_story:
- Active Directory Kerberos Attacks
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.001/impacket/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1558
- T1558.001
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Ticket_Options
- Ticket_Encryption_Type
- dest
- service
- service_id
security_domain: endpoint
impact: 90
confidence: 50
risk_score: 45
context:
- Source:Endpoint
- Stage:Privilege Escalation
message: A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$
observable:
- name: dest
type: Endpoint
role:
- Victim
asset_type: Endpoint
detections/endpoint/kerberos_tgt_request_using_rc4_encryption.yml
+57
View File
@@ -0,0 +1,57 @@
name: Kerberos TGT Request Using RC4 Encryption
id: 18916468-9c04-11ec-bdc6-acde48001122
version: 1
date: '2022-03-04'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic leverages Event 4768, A Kerberos authentication ticket (TGT) was requested, to identify a TGT request with encryption type 0x17, or
RC4-HMAC. This encryption type is no longer utilized by newer systems and could represent evidence of an OverPass The Hash attack. Similar to Pass The Hash, OverPass The Hash
is a form of credential theft that allows adversaries to move laterally or consume resources in a target network. Leveraging this attack, an adversary who has stolen the NTLM
hash of a valid domain account is able to authenticate to the Kerberos Distribution Center(KDC) on behalf of the legitimate account and obtain a Kerberos TGT ticket. Depending on the
privileges of the compromised account, this ticket may be used to obtain unauthorized access to systems and other network resources.
search: ' `wineventlog_security`
EventCode=4768 Ticket_Encryption_Type=0x17 Account_Name!=*$
| `kerberos_tgt_request_using_rc4_encryption_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically,
systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
references:
- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
- https://www.thehacker.recipes/ad/movement/kerberos/ptk
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/impacket/windows-security.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
- T1550
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Ticket_Encryption_Type
- Account_Name
- Client_Address
security_domain: endpoint
impact: 50
confidence: 50
risk_score: 25
context:
- Source:Endpoint
- Stage:Privilege Escalation
message: A Kerberos TGT request with RC4 encryption was requested for $Account_Name$ from $Client_Address$
observable:
- name: Client_Address
type: Endpoint
role:
- Victim
detections/endpoint/kerberos_user_enumeration.yml
+65
View File
@@ -0,0 +1,65 @@
name: Kerberos User Enumeration
id: d82d4af4-a0bd-11ec-9445-3e22fbd008af
version: 1
date: '2022-03-10'
author: Mauricio Velazco, Splunk
type: Anomaly
datamodel: []
description: The following analytic leverages Event Id 4768, A Kerberos authentication ticket (TGT) was requested, to identify
one source endpoint trying to obtain an unusual number Kerberos TGT ticket for non existing users. This behavior could represent an adversary
abusing the Kerberos protocol to perform a user enumeration attack against an Active Directory environment. When Kerberos is sent a TGT request
with no preauthentication for an invalid username, it responds with KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN or 0x6. Red teams and adversaries alike
may abuse the Kerberos protocol to validate a list of users use them to perform further attacks.\
The detection calculates the standard deviation for each host and leverages the
3-sigma statistical rule to identify an unusual number requests. To customize this
analytic, users can try different combinations of the `bucket` span time and the
calculation of the `upperBound` field.
search: ' `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
| `kerberos_user_enumeration_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
known_false_positives: Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
references:
- https://github.com/ropnop/kerbrute
- https://attack.mitre.org/techniques/T1589/002/
- https://www.redsiege.com/blog/2020/04/user-enumeration-part-3-windows/
tags:
analytic_story:
- Active Directory Kerberos Attacks
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1589.002/kerbrute/windows-security.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1589
- T1589.002
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
security_domain: endpoint
impact: 30
confidence: 80
risk_score: 24
context:
- Source:Endpoint
- Stage:Recon
message: Potential Kerberos based user enumeration attack $Client_Address$
observable:
- name: Client_Address
type: Endpoint
role:
- Victim
asset_type: Endpoint
detections/endpoint/linux_common_process_for_elevation_control.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: This analytic is to look for possible elevation control access using
a common known process in linux platform to change the attribute and file ownership.
This technique is commonly abused by adversaries, malware author and red teamers
to gain persistence or privilege escalation on the target or compromised host. Tis
to gain persistence or privilege escalation on the target or compromised host. This
common process is used to modify file attribute, file ownership or SUID. This tools
can be used in legitimate purposes so filter is needed.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+4 -2
View File
@@ -11,8 +11,10 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai
by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections
fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume
high problability of exploitation. The Analytic story breaks down into 3 major phases
of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral
of a Log4Shell exploitation, specifically>
Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
Call back to malicious LDAP server eg. Exploit.class
Post Exploitation Activity/Lateral
Movement using Powershell or similar T1562.001 Each of these phases fall into different
MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking
into 2 or more phases showing up in detections triggerd is how this correlation
detections/endpoint/macos_plutil.yml
+69
View File
@@ -0,0 +1,69 @@
name: MacOS plutil
id: c11f2b57-92c1-4cd2-b46c-064eafb833ac
version: 1
date: '2022-03-29'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
- Endpoint
description: Detect usage of plutil to modify plist files. Adversaries can modiy plist files to executed binaries or add command line
arguments. Plist files in auto-run locations are executed upon user logon or system startup.
search: '`osquery` name=es_process_events columns.path=/usr/bin/plutil
| rename columns.* as *
| stats count min(_time) as firstTime max(_time) as lastTime by username host cmdline pid path parent signing_id
| rename username as User, cmdline as process, path as process_path
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| `macos_plutil_filter`'
how_to_implement: This detection uses osquery and endpoint security on MacOS.
Follow the link in references, which describes how to setup process auditing in MacOS
with endpoint security and osquery.
known_false_positives: Administrators using plutil to change plist files.
references:
- https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
tags:
analytic_story:
- Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.011/atomic_red_team/osquery.log
impact: 50
kill_chain_phases:
- Actions on Objectives
message: plutil are executed on $host$ from $user$
mitre_attack_id:
- T1547.011
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: process
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- columns.cmdline
- columns.pid
- columns.parent
- columns.path
- columns.signing_id
- columns.username
- host
risk_score: 25
security_domain: endpoint
detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
+1
View File
@@ -28,6 +28,7 @@ references:
tags:
analytic_story:
- PetitPotam NTLM Relay on Active Directory Certificate Services
- Active Directory Kerberos Attacks
confidence: 70
context:
- Source:Endpoint
detections/endpoint/rubeus_command_line_parameters.yml
+2 -1
View File
@@ -17,7 +17,7 @@ description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
this analytic.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR
OR Processes.process = "* monitor *" OR Processes.process ="* asktgt* /user:*" OR
Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"
@@ -36,6 +36,7 @@ references:
- https://github.com/GhostPack/Rubeus
- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
- https://attack.mitre.org/techniques/T1550/003/
- https://en.hackndo.com/kerberos-silver-golden-tickets/
tags:
analytic_story:
- Active Directory Kerberos Attacks
detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+1
View File
@@ -33,6 +33,7 @@ references:
tags:
analytic_story:
- sAMAccountName Spoofing and Domain Controller Impersonation
- Active Directory Kerberos Attacks
automated_detection_testing: passed
confidence: 60
context:
detections/endpoint/suspicious_ticket_granting_ticket_request.yml
+1
View File
@@ -34,6 +34,7 @@ references:
tags:
analytic_story:
- sAMAccountName Spoofing and Domain Controller Impersonation
- Active Directory Kerberos Attacks
automated_detection_testing: passed
confidence: 60
context:
detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
+70
View File
@@ -0,0 +1,70 @@
name: Unknown Process Using The Kerberos Protocol
id: c91a0852-9fbb-11ec-af44-acde48001122
version: 1
date: '2022-03-09'
author: Mauricio Velazco, Splunk
type: TTP
datamodel:
- Endpoint
- Network_Traffic
description: The following analytic identifies a process performing an outbound connection on port 88 used by default by the network authentication protocol
Kerberos. Typically, on a regular Windows endpoint, only the lsass.exe process is the one tasked with connecting to the Kerberos Distribution Center
to obtain Kerberos tickets. Identifying an unknown process using this protocol may be evidence of an adversary abusing the Kerberos protocol.
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name!=lsass.exe by _time Processes.process_id
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| join process_id [| tstats `security_content_summariesonly`
count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 88 by All_Traffic.process_id
All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` ]
| table _time dest parent_process_name process_name process_path process process_id dest_port
| `unknown_process_using_the_kerberos_protocol_filter`'
how_to_implement: To successfully implement this search, you must be ingesting your
endpoint events and populating the Endpoint and Network data models.
known_false_positives: Custom applications may leverage the Kerberos protocol. Filter as needed.
references:
- https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
- https://www.thehacker.recipes/ad/movement/kerberos/ptk
tags:
analytic_story:
- Active Directory Kerberos Attacks
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550/rubeus/windows-security.log
kill_chain_phases:
- Reconnaissance
mitre_attack_id:
- T1550
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- All_Traffic.dest_ip
- All_Traffic.dest_port
- All_Traffic.src_ip
- Processes.process_id
- Processes.process_name
- Processes.dest
- Processes.process_path
- Processes.process
- Processes.parent_process_name
security_domain: endpoint
impact: 60
confidence: 60
risk_score: 36
context:
- Source:Endpoint
- Stage:Privilege Escalation
- Stage:Lateral Movement
message: ''
observable:
- name: src_ip
type: IP Address
role:
- Attacker
- name: dest_ip
type: IP Address
role:
- Victim
asset_type: Endpoint
detections/endpoint/windows_event_for_service_disabled.yml
+7 -6
View File
@@ -1,7 +1,7 @@
name: Windows Event For Service Disabled
id: 9c2620a8-94a1-11ec-b40c-acde48001122
version: 1
date: '2022-02-23'
version: 2
date: '2022-04-04'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
@@ -10,10 +10,11 @@ description: This analytic will identify suspicious system event of services tha
was modified from start to disabled. This technique is seen where the adversary
attempts to disable security app services, other malware services to evade the defense
systems on the compromised host
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled."
| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_event_for_service_disabled_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the Service name, Service File Name Service Start type, and Service Type
from your endpoints.
detections/endpoint/windows_get_adcomputer_unconstrained_delegation_discovery.yml
+67
View File
@@ -0,0 +1,67 @@
name: Windows Get-AdComputer Unconstrained Delegation Discovery
id: c8640777-469f-4638-ab44-c34a3233ffac
version: 1
date: '2022-03-28'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the Get-ADComputer commandlet used with specific parameters to discover Windows endpoints with Kerberos Unconstrained Delegation.
Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery.
search: ' `powershell` EventCode=4104 (Message = "*Get-ADComputer*" AND Message = "*TrustedForDelegation*")
| stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_get_adcomputer_unconstrained_delegation_discovery_filter`'
how_to_implement: The following analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
references:
- https://attack.mitre.org/techniques/T1018/
- https://adsecurity.org/?p=1667
- https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
- https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/unconstrained2/windows-powershell.log
impact: 50
kill_chain_phases:
- Reconnaissance
message: Suspicious PowerShell Get-ADComputer was identified on endpoint $ComputerName$
mitre_attack_id:
- T1018
nist:
- DE.CM
observable:
- name: ComputerName
type: Hostname
role:
- Victim
- name: User
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_powerview_constrained_delegation_discovery.yml
+68
View File
@@ -0,0 +1,68 @@
name: Windows PowerView Constrained Delegation Discovery
id: 86dc8176-6e6c-42d6-9684-5444c6557ab3
version: 1
date: '2022-03-31'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Constrained Delegation.
Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*")
AND (Message = "*-TrustedToAuth*") | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_powerview_constrained_delegation_discovery_filter`'
how_to_implement: The following analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
references:
- https://attack.mitre.org/techniques/T1018/
- https://adsecurity.org/?p=1667
- https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
- https://www.guidepointsecurity.com/blog/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
- https://book.hacktricks.xyz/windows/active-directory-methodology/constrained-delegation
- https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/constrained/windows-powershell.log
impact: 50
kill_chain_phases:
- Reconnaissance
message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
mitre_attack_id:
- T1018
nist:
- DE.CM
observable:
- name: ComputerName
type: Hostname
role:
- Victim
- name: User
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
risk_score: 35
security_domain: endpoint
detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml
+67
View File
@@ -0,0 +1,67 @@
name: Windows PowerView Unconstrained Delegation Discovery
id: fbf9e47f-e531-4fea-942d-5c95af7ed4d6
version: 1
date: '2022-03-28'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Unconstrained Delegation.
Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*")
AND (Message = "*-Unconstrained*") | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `windows_powerview_unconstrained_delegation_discovery_filter`'
how_to_implement: The following analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
references:
- https://attack.mitre.org/techniques/T1018/
- https://adsecurity.org/?p=1667
- https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/domain-compromise-via-unrestricted-kerberos-delegation
- https://www.cyberark.com/resources/threat-research-blog/weakness-within-kerberos-delegation
tags:
analytic_story:
- Active Directory Kerberos Attacks
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/unconstrained/windows-powershell.log
impact: 50
kill_chain_phases:
- Reconnaissance
message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
mitre_attack_id:
- T1018
nist:
- DE.CM
observable:
- name: ComputerName
type: Hostname
role:
- Victim
- name: User
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- EventCode
- Message
- ComputerName
- User
risk_score: 35
security_domain: endpoint
detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml
+1
View File
@@ -36,6 +36,7 @@ references:
tags:
analytic_story:
- Active Directory Lateral Movement
- Active Directory Kerberos Attacks
asset_type: Endpoint
confidence: 60
context:
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.37.0"
"version": "3.37.1"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+14 -4
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -501,6 +501,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "nist
known_false_positives = None
providing_technologies = []
[savedsearch://ESCU - GitHub Actions Disable Security Workflow - Rule]
type = detection
asset_type = GitHub
confidence = medium
explanation = This search detects a disabled security workflow in GitHub Actions. An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf. Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.002", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
known_false_positives = unknown
providing_technologies = []
[savedsearch://ESCU - Github Commit Changes In Master - Rule]
type = detection
asset_type = GitHub
@@ -4068,7 +4078,7 @@ providing_technologies = []
type = detection
asset_type = Endpoint
confidence = medium
explanation = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
explanation = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. This common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.001", "T1548"], "nist": ["DE.CM"]}
known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
@@ -4408,7 +4418,7 @@ providing_technologies = []
type = detection
asset_type = endpoint
confidence = medium
explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
@@ -9119,7 +9129,7 @@ version = 1
references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"]
maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
spec_version = 3
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule", "ESCU - AWS ECR Container Upload Outside Business Hours - Rule", "ESCU - AWS ECR Container Upload Unknown User - Rule", "ESCU - Circle CI Disable Security Job - Rule", "ESCU - Circle CI Disable Security Step - Rule", "ESCU - Correlation by Repository and Risk - Rule", "ESCU - Correlation by User and Risk - Rule", "ESCU - GitHub Actions Disable Security Workflow - Rule", "ESCU - Github Commit Changes In Master - Rule", "ESCU - Github Commit In Develop - Rule", "ESCU - GitHub Dependabot Alert - Rule", "ESCU - GitHub Pull Request from Unknown User - Rule", "ESCU - Gsuite Drive Share In External Email - Rule", "ESCU - GSuite Email Suspicious Attachment - Rule", "ESCU - Gsuite Email Suspicious Subject With Attachment - Rule", "ESCU - Gsuite Email With Known Abuse Web Service Link - Rule", "ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule", "ESCU - Gsuite Suspicious Shared File Name - Rule", "ESCU - Kubernetes Nginx Ingress LFI - Rule", "ESCU - Kubernetes Nginx Ingress RFI - Rule", "ESCU - Kubernetes Scanner Image Pulling - Rule"]
description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter.
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 6915
build = 7040
[triggers]
reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 3.37.0
version = 3.37.1
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.37.0
version = 3.37.1
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+5 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -201,6 +201,10 @@ description = Update this macro to limit the output results to filter out false
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_actions_disable_security_workflow_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_commit_changes_in_master_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
dist/escu/default/savedsearches.conf
Vendored
+50 -10
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -2066,6 +2066,46 @@ realtime_schedule = 0
is_visible = false
search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
[ESCU - GitHub Actions Disable Security Workflow - Rule]
action.escu = 0
action.escu.enabled = 1
description = This search detects a disabled security workflow in GitHub Actions. An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.002", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
action.escu.data_models = []
action.escu.eli5 = This search detects a disabled security workflow in GitHub Actions. An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
action.escu.how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf. Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
action.escu.known_false_positives = unknown
action.escu.creation_date = 2022-04-04
action.escu.modification_date = 2022-04-04
action.escu.confidence = high
action.escu.full_search_name = ESCU - GitHub Actions Disable Security Workflow - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
action.escu.providing_technologies = []
action.escu.analytic_story = ["Dev Sec Ops"]
action.risk = 1
action.risk.param._risk_message = Security Workflow is disabled in branch $branch$ for repository $repository$
action.risk.param._risk = [{"threat_object_field": "repository", "threat_object_type": "unknown"}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - GitHub Actions Disable Security Workflow - Rule
action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 90, "context": ["Source:Application Log", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.002", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repository", "role": ["Victim"], "type": "Unknown"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
enableSched = 1
allow_skew = 100%
counttype = number of events
relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` workflow_run.event=push OR workflow_run.event=pull_request | stats values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event workflow_run.head_branch workflow_run.head_commit.author.email workflow_run.head_commit.author.name workflow_run.head_commit.message workflow_run.head_commit.timestamp workflow_run.head_repository.full_name workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login workflow_run.head_repository.owner.type | rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email as user_email, workflow_run.head_repository.full_name as repository, workflow_run.head_branch as branch | search NOT workflow_run.name=*security-testing* | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_actions_disable_security_workflow_filter`
[ESCU - Github Commit Changes In Master - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -2104,7 +2144,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `github` branches{}.name = main OR branches{}.name = master | eval severity="low" | eval phase="code" | stats count min(_time) as firstTime max(_time) as lastTime by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`
search = `github` branches{}.name = main OR branches{}.name = master | stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date repository.full_name | rename commit.author.login as user, repository.full_name as repository | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`
[ESCU - Github Commit In Develop - Rule]
action.escu = 0
@@ -17425,10 +17465,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
[ESCU - Linux Common Process For Elevation Control - Rule]
action.escu = 0
action.escu.enabled = 1
description = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
description = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. This common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.001", "T1548"], "nist": ["DE.CM"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. Tis common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
action.escu.eli5 = This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers to gain persistence or privilege escalation on the target or compromised host. This common process is used to modify file attribute, file ownership or SUID. This tools can be used in legitimate purposes so filter is needed.
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
action.escu.known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
action.escu.creation_date = 2021-12-23
@@ -18815,10 +18855,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
[ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule]
action.escu = 0
action.escu.enabled = 1
description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
action.escu.data_models = ["Risk"]
action.escu.eli5 = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
action.escu.eli5 = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
action.escu.how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
action.escu.known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
action.escu.creation_date = 2022-01-26
@@ -18843,7 +18883,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-4
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = []
action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
action.notable.param.rule_title = Log4Shell CVE-2021-44228 Exploitation
action.notable.param.security_domain = endpoint
action.notable.param.severity = high
@@ -29945,8 +29985,8 @@ action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
action.escu.known_false_positives = Windows service update may cause this event. In that scenario, filtering is needed.
action.escu.creation_date = 2022-02-23
action.escu.modification_date = 2022-02-23
action.escu.creation_date = 2022-04-04
action.escu.modification_date = 2022-04-04
action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Event For Service Disabled - Rule
action.escu.search_type = detection
@@ -29974,7 +30014,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
search = `wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`
search = `wineventlog_system` EventCode=7040 Message = "*service was changed from demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`
[ESCU - Windows Event Log Cleared - Rule]
action.escu = 0
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/ssa/srs/ssa___fsutil_zeroing_file.yml
Vendored
+3 -3
View File
@@ -53,6 +53,6 @@ test:
file: endpoint/ssa___fsutil_zeroing_file.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
source: WinEventLog:Security
docs/Gemfile.lock
+6 -1
View File
@@ -244,12 +244,16 @@ GEM
rb-fsevent (~> 0.10, >= 0.10.3)
rb-inotify (~> 0.9, >= 0.9.10)
mercenary (0.3.6)
mini_portile2 (2.7.1)
minima (2.5.1)
jekyll (>= 3.5, < 5.0)
jekyll-feed (~> 0.9)
jekyll-seo-tag (~> 2.1)
minitest (5.15.0)
multipart-post (2.1.1)
nokogiri (1.13.1)
mini_portile2 (~> 2.7.0)
racc (~> 1.4)
nokogiri (1.13.1-x86_64-darwin)
racc (~> 1.4)
nokogiri (1.13.1-x86_64-linux)
@@ -300,6 +304,7 @@ GEM
zeitwerk (2.5.4)
PLATFORMS
ruby
x86_64-darwin-20
x86_64-linux
@@ -317,4 +322,4 @@ DEPENDENCIES
webrick (~> 1.7)
BUNDLED WITH
2.3.6
2.3.6
docs/_config.yml
+19 -1
View File
@@ -32,8 +32,26 @@ minimal_mistakes_skin: "contrast" #default, neon, dark are also options
# Build settings
markdown: kramdown
highlighter: rouge
lsi: false
excerpt_separator: "\n\n"
incremental: false
# Markdown Processing
kramdown:
input: GFM
hard_wrap: false
auto_ids: true
footnote_nr: 1
entity_output: as_char
toc_levels: 1..6
smart_quotes: lsquo,rsquo,ldquo,rdquo
enable_coderay: false
syntax_highlighter_opts:
block:
line_numbers: true
remote_theme: mmistakes/minimal-mistakes
# Outputting
permalink: /:categories/:title/
paginate: 5 # amount of posts to show
@@ -149,4 +167,4 @@ analytics:
provider: "google-gtag"
google:
tracking_id: "G-294P2LYRR5"
anonymize_ip: false # default
anonymize_ip: false # default
docs/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
docs/_layouts/single.html
+2 -2
View File
@@ -14,10 +14,10 @@ layout: default
{% endunless %}
{% endif %}
<div id="main" role="main">
<div id="main" role="main" style="max-width:95%">
{% include sidebar.html %}
<article class="page h-entry" itemscope itemtype="https://schema.org/CreativeWork">
<article style="width:95%" class="page h-entry" itemscope itemtype="https://schema.org/CreativeWork">
{% if page.title %}<meta itemprop="headline" content="{{ page.title | markdownify | strip_html | strip_newlines | escape_once }}">{% endif %}
{% if page.excerpt %}<meta itemprop="description" content="{{ page.excerpt | markdownify | strip_html | strip_newlines | escape_once }}">{% endif %}
{% if page.date %}<meta itemprop="datePublished" content="{{ page.date | date_to_xmlschema }}">{% endif %}
docs/_pages/detections.md
+837 -836
View File
File diff suppressed because it is too large Load Diff
docs/_pages/stories.md
+1 -1
View File
@@ -47,7 +47,7 @@ sidebar:
| [Data Protection](data_protection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
| [Detect Zerologon Attack](detect_zerologon_attack) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Credential Access](/tags/#credential-access), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) |
| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
| [Double Zero Destructor](double_zero_destructor) | [Masquerading](/tags/#masquerading), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
+68 -16
View File
@@ -22,14 +22,77 @@ tags:
The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Vulnerabilities](https://docs.splunk.com/Documentation/CIM/latest/User/Vulnerabilities)
- **Last Updated**: 2017-01-07
- **Author**: David Dorsey, Splunk
- **ID**: 354be8e0-32cd-4da0-8c47-796de13b60ea
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
</div>
</details>
#### Search
```
@@ -43,10 +106,10 @@ The search is used to detect systems that are still vulnerable to the Spectre an
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `spectre_and_meltdown_vulnerable_systems_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +125,6 @@ It is possible that your vulnerability scanner is not detecting that the patches
* [Spectre And Meltdown Vulnerabilities](/stories/spectre_and_meltdown_vulnerabilities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -74,19 +134,11 @@ It is possible that your vulnerability scanner is not detecting that the patches
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+63 -10
View File
@@ -23,14 +23,72 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: bce3ed7c-9b1f-42a0-abdf-d8b123a34836
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -46,10 +104,10 @@ The search queries the authentication logs for assets that are categorized as ro
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_new_login_attempts_to_routers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +126,6 @@ Legitimate router connections may appear as new connections
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -80,13 +135,11 @@ Legitimate router connections may appear as new connections
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+61 -10
View File
@@ -20,14 +20,70 @@ tags:
This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aef-952c-3ea214444440
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -43,10 +99,10 @@ This search returns a list of hosts that have not successfully completed a backu
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `extended_period_without_successful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -64,9 +120,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -76,13 +129,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-identify_new_user_accounts.md
+59 -10
View File
@@ -26,21 +26,75 @@ tags:
This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: 475b9e27-17e4-46e2-b7e2-648221be3b89
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +112,7 @@ This detection search will help profile user accounts in your environment by ide
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `identify_new_user_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ If the Identity_Management data model is not updated regularly, this search coul
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -86,13 +137,11 @@ If the Identity_Management data model is not updated regularly, this search coul
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+61 -10
View File
@@ -20,14 +20,70 @@ tags:
This search gives you the hosts where a backup was attempted and then failed.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aaa-952c-3ea21444444f
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -42,10 +98,10 @@ This search gives you the hosts where a backup was attempted and then failed.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `unsuccessful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +117,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -73,13 +126,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+63 -11
View File
@@ -23,14 +23,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Sessions](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions)
- **Last Updated**: 2017-09-13
- **Author**: Bhavin Patel, Splunk
- **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Reconnaissance
* Delivery
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
* PR.DS
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,7 +109,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_unauthorized_assets_by_mac_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,11 +128,6 @@ This search might be prone to high false positives. Please consider this when co
* [Asset Tracking](/stories/asset_tracking)
#### Kill Chain Phase
* Reconnaissance
* Delivery
* Actions on Objectives
#### RBA
@@ -83,13 +137,11 @@ This search might be prone to high false positives. Please consider this when co
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+62 -10
View File
@@ -23,14 +23,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Updates](https://docs.splunk.com/Documentation/CIM/latest/User/Updates)
- **Last Updated**: 2017-09-15
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.MA
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -49,10 +106,10 @@ This search looks for Windows endpoints that have not generated an event indicat
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `no_windows_updates_in_a_time_frame_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +128,6 @@ None identified
* [Monitor for Updates](/stories/monitor_for_updates)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -83,13 +137,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+61 -10
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
- **Last Updated**: 2017-09-19
- **Author**: David Dorsey, Splunk
- **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -47,10 +103,10 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `email_attachments_with_lots_of_spaces_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -86,13 +139,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
+71 -15
View File
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-19
- **Author**: Bhavin Patel, Splunk
- **ID**: d199fb99-2312-451a-9daa-e5efa6ed76a7
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.AC
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
</div>
</details>
#### Search
```
@@ -39,7 +106,7 @@ index=_internal sourcetype=splunk_web_access return_to="/%09/*"
#### Macros
The SPL above uses the following Macros:
Note that `open_redirect_in_splunk_web_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -55,9 +122,6 @@ None identified
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -67,19 +131,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+62 -10
View File
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2017-09-20
- **Author**: Bhavin Patel, Splunk
- **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
| [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.AE
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -60,7 +117,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `large_volume_of_dns_any_queries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +136,6 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
* [DNS Amplification Attacks](/stories/dns_amplification_attacks)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +145,11 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+56 -11
View File
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499e-9719-17243f982681
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Reconnaissance
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -54,10 +104,10 @@ This search looks for specific GET or HEAD requests to web servers that are indi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Reconnaissance
#### RBA
@@ -90,13 +137,11 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+68 -10
View File
@@ -23,14 +23,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* PR.PT
* PR.IP
* DE.AE
* PR.MA
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -46,10 +109,10 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_malicious_requests_to_exploit_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +134,6 @@ No known false positives for this detection.
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -83,13 +143,11 @@ No known false positives for this detection.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+59 -12
View File
@@ -21,14 +21,67 @@ tags:
This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 24dd17b1-e2fb-4c31-878c-d4f746595bfa
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -42,11 +95,11 @@ This search looks for DNS requests for faux domains similar to the domains that
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,10 +115,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
#### Kill Chain Phase
* Delivery
* Actions on Objectives
#### RBA
@@ -75,13 +124,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+61 -10
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,11 +100,11 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -66,9 +122,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -78,13 +131,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-10-13-unusually_long_content-type_length.md
+69 -9
View File
@@ -22,14 +22,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for unusually long strings in the Content-Type http header that the client sends the server.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-10-13
- **Author**: Bhavin Patel, Splunk
- **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.IP
* DE.AE
* PR.MA
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,7 +109,7 @@ This search looks for unusually long strings in the Content-Type http header tha
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `unusually_long_content-type_length_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,9 +130,6 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -77,13 +139,11 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-11-27-detect_usb_device_insertion.md
+63 -11
View File
@@ -21,14 +21,72 @@ tags:
The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change_Analysis](https://docs.splunk.com/Documentation/CIM/latest/User/ChangeAnalysis)
- **Last Updated**: 2017-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499f-9719-17a43f9826f5
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.DS
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -42,10 +100,10 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_usb_device_insertion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,10 +123,6 @@ Legitimate USB activity will also be detected. Please verify and investigate as
* [Data Protection](/stories/data_protection)
#### Kill Chain Phase
* Installation
* Actions on Objectives
#### RBA
@@ -78,13 +132,11 @@ Legitimate USB activity will also be detected. Please verify and investigate as
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+61 -10
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
- **Last Updated**: 2018-01-05
- **Author**: David Dorsey, Splunk
- **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -49,10 +105,10 @@ This search looks for emails claiming to be sent from a domain similar to one th
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `monitor_email_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -77,9 +133,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -89,13 +142,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+61 -11
View File
@@ -23,21 +23,76 @@ tags:
This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-02-23
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362d6fd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,10 +110,10 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `ec2_instance_started_in_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +131,6 @@ It's possible that a user has unknowingly started an instance in a new region. P
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -88,13 +140,11 @@ It's possible that a user has unknowingly started an instance in a new region. P
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+61 -10
View File
@@ -20,14 +20,70 @@ tags:
This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-12
- **Author**: David Dorsey, Splunk
- **ID**: 347ec301-601b-48b9-81aa-9ddf9c829dd3
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,10 +106,10 @@ This search looks for EC2 instances being created with previously unseen AMIs.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `ec2_instance_started_with_previously_unseen_ami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +128,6 @@ After a new AMI is created, the first systems created with that AMI will cause t
* [AWS Cryptomining](/stories/aws_cryptomining)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -84,13 +137,11 @@ After a new AMI is created, the first systems created with that AMI will cause t
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 344a1778-0b25-490c-adb1-de8beddf59cd
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen cities.
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: ceb8d3d8-06cb-49eb-beaf-829526e33ff0
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen countri
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 42e15012-ac14-4801-94f4-f1acbe64880b
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +108,7 @@ This search looks for AWS provisioning activities from previously unseen IP addr
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +127,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -83,13 +136,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 7971d3df-da82-4648-a6e5-b5637bea5253
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen regions
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+60 -11
View File
@@ -26,21 +26,75 @@ tags:
This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-04-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 22773e84-bac0-4595-b086-20d3f335b4f1
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -63,10 +117,10 @@ This search detects new API calls that have either never been seen before or tha
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_new_api_calls_from_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -92,9 +146,6 @@ It is possible that there are legitimate user roles making new or infrequently u
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -104,13 +155,11 @@ It is possible that there are legitimate user roles making new or infrequently u
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+61 -10
View File
@@ -26,21 +26,77 @@ tags:
This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-04-18
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-e32372d4bd53
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -71,7 +127,7 @@ The SPL above uses the following Macros:
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
+63 -10
View File
@@ -22,14 +22,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-07
- **Author**: Bhavin Patel, Splunk
- **ID**: d3fffa37-492f-487b-a35d-c60fcb2acf01
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +115,7 @@ This search will detect spike in blocked outbound network connections originatin
The SPL above uses the following Macros:
* [cloudwatchlogs_vpcflow](https://github.com/splunk/security_content/blob/develop/macros/cloudwatchlogs_vpcflow.yml)
Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -83,10 +142,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [Command and Control](/stories/command_and_control)
#### Kill Chain Phase
* Actions on Objectives
* Command & Control
#### RBA
@@ -96,13 +151,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+62 -10
View File
@@ -20,14 +20,71 @@ tags:
This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-17
- **Author**: Bhavin Patel, Splunk
- **ID**: 4d46e8bd-4072-48e4-92db-0325889ef894
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,10 +101,10 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_api_activity_from_users_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -79,9 +136,6 @@ Many service accounts configured within an AWS infrastructure do not have multi
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -91,13 +145,11 @@ Many service accounts configured within an AWS infrastructure do not have multi
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
+62 -10
View File
@@ -23,21 +23,78 @@ tags:
This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a1f1-e32372d4bd53
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -68,7 +125,7 @@ The SPL above uses the following Macros:
* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_network_acl_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -91,9 +148,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -103,13 +157,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+61 -11
View File
@@ -26,21 +26,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
- **Last Updated**: 2018-06-01
- **Author**: Rico Valdez, Splunk
- **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 9
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,10 +110,10 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_large_outbound_icmp_packets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
* [Command and Control](/stories/command_and_control)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -93,13 +145,11 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
+71 -15
View File
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-06-14
- **Author**: David Dorsey, Splunk
- **ID**: f6a26b7b-7e80-4963-a9a8-d836e7534ebd
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.AC
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
</div>
</details>
#### Search
```
@@ -45,7 +112,7 @@ index=_internal sourcetype=splunkd_ui_access server-info
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `splunk_enterprise_information_disclosure_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +128,6 @@ Retrieving server information may be a legitimate API request. Verify that the a
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -73,19 +137,11 @@ Retrieving server information may be a legitimate API request. Verify that the a
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+63 -11
View File
@@ -25,21 +25,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-06-28
- **Author**: Bhavin Patel, Splunk
- **ID**: e6f1bb1b-f441-492b-9126-902acda217da
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.DS
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
* CIS 14
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -61,10 +118,10 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_s3_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +140,6 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -95,13 +149,11 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
+60 -10
View File
@@ -23,21 +23,76 @@ tags:
This search is used to identify the creation of multiple user accounts using the same email domain name.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: bf1d7b5c-df2f-4249-a401-c09fdc221ddf
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +111,7 @@ This search is used to identify the creation of multiple user accounts using the
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_account_harvesting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://splunkbase.splunk.com/app/2734/](https://splunkbase.splunk.com/app/2734/)
@@ -97,7 +147,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337bbb-bc22-4752-b599-ef192df2dc7a
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,7 +112,7 @@ This search is used to examine web sessions to identify those where the clicks a
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_anomalous_user_clickspeed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -99,7 +149,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search is used to identify user accounts that share a common password.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337a1a-53b9-4e05-96e9-55c934cb71d3
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +101,7 @@ This search is used to identify user accounts that share a common password.
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_password_sharing_across_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -63,9 +119,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -75,8 +128,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -87,7 +138,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
+61 -10
View File
@@ -21,14 +21,70 @@ tags:
This search looks for cloud compute instances being created with previously unseen image IDs.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2018-10-12
- **Author**: David Dorsey, Splunk
- **ID**: bc24922d-987c-4645-b288-f8c73ec194c4
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -51,7 +107,7 @@ This search looks for cloud compute instances being created with previously unse
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `cloud_compute_instance_created_with_previously_unseen_image_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -76,9 +132,6 @@ After a new image is created, the first systems created with that image will cau
* [Cloud Cryptomining](/stories/cloud_cryptomining)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -88,13 +141,11 @@ After a new image is created, the first systems created with that image will cau
| 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+64 -11
View File
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI permanent event subscriptions.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +114,10 @@ This search looks for the creation of WMI permanent event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +137,6 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +146,11 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+64 -11
View File
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI temporary event subscriptions.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,10 +113,10 @@ This search looks for the creation of WMI temporary event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +135,6 @@ Some software may create WMI temporary event subscriptions for various purposes.
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +144,11 @@ Some software may create WMI temporary event subscriptions for various purposes.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-11-02-windows_hosts_file_modification.md
+67 -10
View File
@@ -20,14 +20,76 @@ tags:
The search looks for modifications to the hosts file on all Windows endpoints across your environment.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-11-02
- **Author**: Rico Valdez, Splunk
- **ID**: 06a6fc63-a72d-41dc-8736-7e3dd9612116
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
* PR.PT
* PR.AC
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 8
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -42,10 +104,10 @@ The search looks for modifications to the hosts file on all Windows endpoints ac
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `windows_hosts_file_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +123,6 @@ There may be legitimate reasons for system administrators to add entries to this
* [Host Redirection](/stories/host_redirection)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -73,13 +132,11 @@ There may be legitimate reasons for system administrators to add entries to this
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+61 -10
View File
@@ -25,21 +25,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: e733a326-59d2-446d-b8db-14a17151aa68
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -70,7 +126,7 @@ This search detects users creating spikes in API activity related to deletion of
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+66 -13
View File
@@ -24,21 +24,79 @@ tags:
The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,11 +110,11 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +138,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
* [Living Off The Land](/stories/living_off_the_land)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -92,8 +147,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
| 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml)
@@ -101,7 +154,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-03-usn_journal_deletion.md
+67 -12
View File
@@ -24,21 +24,81 @@ tags:
The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: David Dorsey, Splunk
- **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
* PR.PT
* DE.AE
* DE.DP
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
* CIS 8
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -53,10 +113,10 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `usn_journal_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +139,6 @@ None identified
* [Ransomware](/stories/ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +148,11 @@ None identified
| 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-06-suspicious_java_classes.md
+61 -9
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-12-06
- **Author**: Jose Hernandez, Splunk
- **ID**: 6ed33786-5e87-4f55-b62c-cb5f1168b831
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -48,7 +105,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `suspicious_java_classes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +129,6 @@ There are no known false positives.
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -84,13 +138,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-14-file_with_samsam_extension.md
+63 -11
View File
@@ -21,14 +21,71 @@ tags:
The search looks for file writes with extensions consistent with a SamSam ransomware attack.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,10 +101,10 @@ The search looks for file writes with extensions consistent with a SamSam ransom
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `file_with_samsam_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ Because these extensions are not typically used in normal operations, you should
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Installation
#### RBA
@@ -79,13 +133,11 @@ Because these extensions are not typically used in normal operations, you should
| 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-14-samsam_test_file_write.md
+62 -12
View File
@@ -24,21 +24,76 @@ tags:
The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,10 +107,10 @@ The search looks for a file named "test.txt" written to the windows system direc
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `samsam_test_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ No false positives have been identified.
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -87,13 +139,11 @@ No false positives have been identified.
| 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
+61 -9
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-01-25
- **Author**: Jose Hernandez, Splunk
- **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +102,7 @@ This search looks for processes in an MacOS system that is tapping keyboard even
#### Macros
The SPL above uses the following Macros:
Note that `processes_tapping_keyboard_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ There might be some false positives as keyboard event taps are used by processes
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -79,13 +133,11 @@ There might be some false positives as keyboard event taps are used by processes
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
+64 -10
View File
@@ -20,14 +20,74 @@ tags:
This search looks for ColdRoot events from the osx-attacks osquery pack.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-01-29
- **Author**: Rico Valdez, Splunk
- **ID**: a6fffe5e-05c3-4c04-badc-887607fbb8dc
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.PT
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -43,7 +103,7 @@ This search looks for ColdRoot events from the osx-attacks osquery pack.
#### Macros
The SPL above uses the following Macros:
Note that `osquery_pack_-_coldroot_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,10 +119,6 @@ There are no known false positives.
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
#### Kill Chain Phase
* Installation
* Command & Control
#### RBA
@@ -72,13 +128,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+64 -11
View File
@@ -23,21 +23,79 @@ tags:
This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-02-27
- **Author**: Rico Valdez, Splunk
- **ID**: 98917be2-bfc8-475a-8618-a9bb06575188
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -54,10 +112,10 @@ This search looks for PowerShell requesting privileges consistent with credentia
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_mimikatz_via_powershell_and_eventcode_4703_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +136,6 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -90,13 +145,11 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+60 -11
View File
@@ -24,21 +24,75 @@ tags:
The search looks for command-line arguments used to hide a file or directory using the reg add command.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2019-02-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -53,10 +107,10 @@ The search looks for command-line arguments used to hide a file or directory usi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ None at the moment
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -86,13 +137,11 @@ None at the moment
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+60 -11
View File
@@ -26,21 +26,75 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious processes on all systems labeled as web servers.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2019-04-01
- **Author**: David Dorsey, Splunk
- **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -54,10 +108,10 @@ This search looks for suspicious processes on all systems labeled as web servers
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `web_servers_executing_suspicious_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +132,6 @@ Some of these processes may be used legitimately on web servers during maintenan
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -90,13 +141,11 @@ Some of these processes may be used legitimately on web servers during maintenan
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-04-25-suspicious_file_write.md
+63 -11
View File
@@ -20,14 +20,71 @@ tags:
The search looks for files created with names that have been linked to malicious activity.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-04-25
- **Author**: Rico Valdez, Splunk
- **ID**: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -42,11 +99,11 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +119,6 @@ It's possible for a legitimate file to be created with the same name as one note
* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -74,13 +128,11 @@ It's possible for a legitimate file to be created with the same name as one note
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+62 -10
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-05-08
- **Author**: Rico Valdez, Splunk
- **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -49,10 +106,10 @@ Command lines that are extremely long may be indicative of malicious activity on
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `unusually_long_command_line_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +132,6 @@ Some legitimate applications use long command lines for installs or updates. You
* [Ransomware](/stories/ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,13 +141,11 @@ Some legitimate applications use long command lines for installs or updates. You
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)

Some files were not shown because too many files have changed in this diff Show More