diff --git a/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py b/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py index f793f77481..aa182ad107 100644 --- a/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py +++ b/bin/contentctl_project/contentctl_core/application/builder/detection_builder.py @@ -56,6 +56,10 @@ class DetectionBuilder(abc.ABC): def addCve(self) -> None: pass + @abc.abstractmethod + def addSplunkApp(self) -> None: + pass + @abc.abstractmethod def setObject(self, path: str) -> None: pass diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection.py b/bin/contentctl_project/contentctl_core/domain/entities/detection.py index 9c2f74d1c0..0e9c81dc21 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection.py @@ -48,6 +48,7 @@ class Detection(BaseModel, SecurityContentObject): macros: list[Macro] = None lookups: list[Lookup] = None cve_enrichment: list = None + splunk_app_enrichment: list = None file_path: str = None source: str = None diff --git a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py index 3b4db94ce7..e506ad08d9 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py @@ -26,6 +26,7 @@ class DetectionTags(BaseModel): security_domain: str risk_severity: str = None cve: list = None + supported_tas: list = None # enrichment mitre_attack_enrichments: list[MitreAttackEnrichment] = None diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 index ca37c470b4..b443d7d8de 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 @@ -38,7 +38,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. {% endif %} -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -46,7 +46,8 @@ We have not been able to test, simulate, or build datasets for this object. Use - **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: {{ object.tags.product|join(', ') }} -- **Datamodel**: {% for datamodel in object.datamodel %}[{{ datamodel }}](https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}}){% if not loop.last %}, {% endif %}{%-endfor %} +{% if object.datamodel -%}- **Datamodel**: {% for datamodel in object.datamodel %}[{{ datamodel }}](https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %} +{% if object.splunk_app_enrichment -%}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %} - **Last Updated**: {{ object.date }} - **Author**: {{object.author}} - **ID**: {{ object.id }} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index 052fba03ad..08cd5c3760 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -11,6 +11,7 @@ from bin.contentctl_project.contentctl_core.domain.entities.security_content_obj from bin.contentctl_project.contentctl_core.domain.entities.macro import Macro from bin.contentctl_project.contentctl_core.domain.entities.mitre_attack_enrichment import MitreAttackEnrichment from bin.contentctl_project.contentctl_infrastructure.builder.cve_enrichment import CveEnrichment +from bin.contentctl_project.contentctl_infrastructure.builder.splunk_app_enrichment import SplunkAppEnrichment class SecurityContentDetectionBuilder(DetectionBuilder): @@ -222,6 +223,12 @@ class SecurityContentDetectionBuilder(DetectionBuilder): for cve in self.security_content_obj.tags.cve: self.security_content_obj.cve_enrichment.append(CveEnrichment.enrich_cve(cve)) + def addSplunkApp(self) -> None: + if self.security_content_obj: + self.security_content_obj.splunk_app_enrichment = [] + if self.security_content_obj.tags.supported_tas: + for splunk_app in self.security_content_obj.tags.supported_tas: + self.security_content_obj.splunk_app_enrichment.append(SplunkAppEnrichment.enrich_splunk_app(splunk_app)) def reset(self) -> None: self.security_content_obj = None diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py index f94eca3be6..5475ded773 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py @@ -27,6 +27,7 @@ class SecurityContentDirector(Director): builder.addMacros(macros) builder.addLookups(lookups) builder.addCve() + builder.addSplunkApp() def constructStory(self, builder: StoryBuilder, path: str, detections: list, baselines: list, investigations: list) -> None: diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/splunk_app_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/builder/splunk_app_enrichment.py new file mode 100644 index 0000000000..0a3c520bdf --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/builder/splunk_app_enrichment.py @@ -0,0 +1,46 @@ +import requests +import xmltodict +import json + +SPLUNKBASE_API_URL = "https://apps.splunk.com/api/apps/entriesbyid/" + + +class SplunkAppEnrichment(): + + @classmethod + def enrich_splunk_app(self, splunk_ta: str) -> dict: + appurl = SPLUNKBASE_API_URL + splunk_ta + splunk_app_enriched = dict() + try: + response = requests.get(appurl) + response_dict = xmltodict.parse(response.content) + # check if list since data changes depending on answer + url, results = self._parse_splunkbase_response(response_dict) + # grab the app name + for i in results: + if i['@name'] == 'appName': + splunk_app_enriched['name'] = i['#text'] + # grab out the splunkbase url + if 'entriesbyid' in url: + response = requests.get(url) + response_dict = xmltodict.parse(response.content) + #print(json.dumps(response_dict, indent=2)) + url, results = self._parse_splunkbase_response(response_dict) + # chop the url so we grab the splunkbase portion but not direct download + splunk_app_enriched['url'] = url.rsplit('/', 4)[0] + except requests.exceptions.ConnectionError as connErr: + # there was a connection error lets just capture the name + splunk_app_enriched['name'] = splunk_ta + splunk_app_enriched['url'] = '' + + return splunk_app_enriched + + def _parse_splunkbase_response(response_dict): + if isinstance(response_dict['feed']['entry'], list): + url = response_dict['feed']['entry'][0]['link']['@href'] + results = response_dict['feed']['entry'][0]['content']['s:dict']['s:key'] + else: + url = response_dict['feed']['entry']['link']['@href'] + results = response_dict['feed']['entry']['content']['s:dict']['s:key'] + return url, results + diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json index 3d18604511..f51179306f 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json @@ -101,6 +101,9 @@ "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], "mitre_attack_enrichments": [ { "mitre_attack_id": "T1003.002", @@ -153,6 +156,12 @@ ], "lookups": [], "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection" } diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index 540702941a..208de8a43b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -184,6 +184,9 @@ "risk_score": 90, "security_domain": "endpoint", "risk_severity": "high", + "supported_tas": [ + "Splunk_TA_microsoft_sysmon" + ], "mitre_attack_enrichments": [ { "mitre_attack_id": "T1003.002", @@ -422,6 +425,12 @@ ], "lookups": [], "cve_enrichment": [], + "splunk_app_enrichment": [ + { + "name": "Splunk Add-on for Sysmon", + "url": "https://splunkbase.splunk.com/app/5709" + } + ], "file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml", "source": "detection" } diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md index cb61304499..789ce441ac 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75 diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index a1bccedf77..99eb9e769b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md index cb61304499..789ce441ac 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75 diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index a1bccedf77..99eb9e769b 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/valid.yml b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/valid.yml index 68a1d82348..5b1f174b0a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/valid.yml +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/detection/valid.yml @@ -86,3 +86,5 @@ tags: - Processes.parent_process_id risk_score: 90 security_domain: endpoint + supported_tas: + - Splunk_TA_microsoft_sysmon diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_splunk_app_enrichment.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_splunk_app_enrichment.py new file mode 100644 index 0000000000..2c756bebeb --- /dev/null +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_splunk_app_enrichment.py @@ -0,0 +1,9 @@ + + +from bin.contentctl_project.contentctl_infrastructure.builder.splunk_app_enrichment import SplunkAppEnrichment + + +def test_splunk_app_enrichment(): + splunk_app_enriched = SplunkAppEnrichment.enrich_splunk_app('Splunk_TA_microsoft_sysmon') + assert splunk_app_enriched['name'] == 'Splunk Add-on for Sysmon' + assert splunk_app_enriched['url'] == 'https://splunkbase.splunk.com/app/5709' \ No newline at end of file diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index aa2e74ebc8..986f15680c 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 79164e8021..a3187d076a 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml index 8c6fee6165..0ae28c2751 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml index 14c9cec4e8..3261f9854d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml index 5f5b4b9803..d5c51c01a0 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml index dc910e71a9..b88d88c75c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml index 9a8851068d..d0393869e8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml index c9d3e10438..0816e56b98 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml index e308691e8e..9d67e7096b 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml index 6fda19dee1..f050edf0ed 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml index fc4fff7fe5..b618ef1017 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml index 5b2966efd9..8a951e2560 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml index 6702ff82e1..7ca7932434 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml index 70173d6fb8..fdee390a2d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml index b4a52374a9..51e214f1a4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml index 52aec66472..07b48a5706 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml index 81a26c33b4..ff6643a0b8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml index e243527301..569bea2d0a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml index 0f9a5a0a44..df2277e276 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml index b0a3d07cca..771bbd3d21 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml index c52d7fc1d3..af23b3ca63 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml index 03dd72ee95..af7496316f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml index 4318893e16..7cf0fb3f1f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml index 4afc01b14b..e717e2e8d2 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml index 1e592ef802..47126520da 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml index 6a04d33d0d..50e4e72d98 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml index 9b4c01481e..8c90504bb6 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml index 13e9605b54..ad89dbe97d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml index 800f48acf3..5d30f8605d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml index 4f911004dd..56d22feab4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml index e2865244dc..867e390b86 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml index a467c85a5c..393fcade2e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml index e581352281..737939a343 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml index 61b2c13f56..ee32d1d902 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml index bf5d89330a..70b4f6cdf1 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml index dd6dbf1381..1118646e50 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml index e59e255232..24e93ff0aa 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml index 0a65dbef19..4cdbcb8a5f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml index 4f1ba794dd..438eaa701f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml index 03d833a610..ee37c2db63 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml index b150a9195c..e17089fb6f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml index 81eb984f3e..d44d376248 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml index c764885a64..3a4ae3256c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml index f0e38cab50..a5725fb9db 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml index d8dcc3802a..ed822bb389 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml index 444fd538b1..0a6989ca5f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml index 63d2036594..a6c8480589 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:44 UTC +# On Date: 2022-03-24T08:24:12 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index e71a9837f1..764c7e526e 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 3e60c90ae7..599b52e09d 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 979b0ec771..2f1da37d14 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 93d7de4824..39d656c98b 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index 8246cb0254..b6be3690eb 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-21T07:44:43 UTC +# On Date: 2022-03-24T08:24:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock index 15d456a926..43748f458f 100644 --- a/docs/Gemfile.lock +++ b/docs/Gemfile.lock @@ -250,6 +250,8 @@ GEM jekyll-seo-tag (~> 2.1) minitest (5.15.0) multipart-post (2.1.1) + nokogiri (1.13.1-x86_64-darwin) + racc (~> 1.4) nokogiri (1.13.1-x86_64-linux) racc (~> 1.4) octokit (4.22.0) @@ -298,6 +300,7 @@ GEM zeitwerk (2.5.4) PLATFORMS + x86_64-darwin-20 x86_64-linux DEPENDENCIES diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md index 3df33b8ace..1d11e3769b 100644 --- a/docs/_pages/detections.md +++ b/docs/_pages/detections.md @@ -300,7 +300,7 @@ sidebar: | [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly | | [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Excessive Usage of NSLOOKUP App](/endpoint/excessive_usage_of_nslookup_app/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | Anomaly | -| [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | +| [Excessive distinct processes from Windows Temp](/endpoint/excessive_distinct_processes_from_windows_temp/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | | [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly | | [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery) | Anomaly | | [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | @@ -402,8 +402,8 @@ sidebar: | [Kubernetes AWS detect sensitive role access]() | None | Hunting | | [Kubernetes AWS detect service accounts forbidden failure access]() | None | Hunting | | [Kubernetes AWS detect suspicious kubectl calls]() | None | Hunting | +| [Kubernetes Azure active service accounts by pod namespace]() | None | Hunting | | [Kubernetes Azure detect RBAC authorization by account]() | None | Hunting | -| [Kubernetes Azure detect most active service accounts by pod namespace]() | None | Hunting | | [Kubernetes Azure detect sensitive object access]() | None | Hunting | | [Kubernetes Azure detect sensitive role access]() | None | Hunting | | [Kubernetes Azure detect service accounts forbidden failure access]() | None | Hunting | @@ -463,20 +463,20 @@ sidebar: | [Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly | | [Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly | | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP | +| [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | | [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly | | [MSBuild Suspicious Spawned By Script Process](/endpoint/msbuild_suspicious_spawned_by_script_process/) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP | | [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP | | [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | Hunting | | [MacOS - Re-opened Applications]() | None | TTP | +| [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Mailsniper Invoke functions](/endpoint/mailsniper_invoke_functions/) | [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection) | TTP | | [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | TTP | | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information) | Hunting | | [Malicious PowerShell Process - Execution Policy Bypass](/endpoint/malicious_powershell_process_-_execution_policy_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | -| [Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments](/deprecated/malicious_powershell_process_-_multiple_suspicious_command-line_arguments/) | [PowerShell](/tags/#powershell) | TTP | | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | TTP | -| [Microsoft Exchange Mailbox Replication service writing Active Server Pages](/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | TTP | | [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP | | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP | @@ -488,11 +488,8 @@ sidebar: | [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP | | [Msmpeng Application DLL Side Loading](/endpoint/msmpeng_application_dll_side_loading/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP | | [Multiple Archive Files Http Post Traffic](/network/multiple_archive_files_http_post_traffic/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | TTP | -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Multiple Okta Users With Invalid Credentials From The Same IP](/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip/) | [Valid Accounts](/tags/#valid-accounts), [Default Accounts](/tags/#default-accounts) | TTP | -| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | @@ -555,7 +552,7 @@ sidebar: | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | Hunting | | [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting | -| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | +| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP | | [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | TTP | | [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | TTP | | [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | @@ -701,6 +698,7 @@ sidebar: | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP | | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious PlistBuddy Usage via OSquery](/endpoint/suspicious_plistbuddy_usage_via_osquery/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | +| [Suspicious Powershell Command-Line Arguments](/deprecated/suspicious_powershell_command-line_arguments/) | [PowerShell](/tags/#powershell) | TTP | | [Suspicious Process DNS Query Known Abuse Web Services](/endpoint/suspicious_process_dns_query_known_abuse_web_services/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | TTP | | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP | | [Suspicious Process With Discord DNS Query](/endpoint/suspicious_process_with_discord_dns_query/) | [Visual Basic](/tags/#visual-basic), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | Anomaly | @@ -779,8 +777,15 @@ sidebar: | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP | | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | +| [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | +| [Windows Disable LogOff Button Through Registry](/endpoint/windows_disable_logoff_button_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | | [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction) | TTP | +| [Windows Disable Notification Center](/endpoint/windows_disable_notification_center/) | [Modify Registry](/tags/#modify-registry) | Anomaly | +| [Windows Disable Shutdown Button Through Registry](/endpoint/windows_disable_shutdown_button_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | +| [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | +| [Windows Disabled Users Failing To Authenticate Kerberos](/endpoint/windows_disabled_users_failing_to_authenticate_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | Hunting | | [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP | @@ -788,6 +793,7 @@ sidebar: | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | TTP | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP | | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | TTP | +| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly | | [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | Anomaly | | [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting | | [Windows InstallUtil Credential Theft](/endpoint/windows_installutil_credential_theft/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | @@ -796,6 +802,7 @@ sidebar: | [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | | [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | TTP | | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil) | TTP | +| [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Windows Java Spawning Shells](/endpoint/windows_java_spawning_shells/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry) | TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | TTP | @@ -815,6 +822,7 @@ sidebar: | [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP | | [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | | [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP | +| [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly | | [Windows WMI Process Call Create](/endpoint/windows_wmi_process_call_create/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | Hunting | | [Windows connhost exe started forcefully](/deprecated/windows_connhost_exe_started_forcefully/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP | | [Windows hosts file modification]() | None | TTP | diff --git a/docs/_pages/paybooks.md b/docs/_pages/paybooks.md index 37bdd07198..1a71491911 100644 --- a/docs/_pages/paybooks.md +++ b/docs/_pages/paybooks.md @@ -15,7 +15,7 @@ sidebar: | [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response | | [Block Indicators](/playbooks/block_indicators/)| None | Response | | [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response | -| [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response | +| [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share]((/detection/executable_file_written_in_administrative_smb_share/)| Response | | [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response | | [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation | | [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation | @@ -23,11 +23,11 @@ sidebar: | [Internal Host WinRM Investigate](/playbooks/internal_host_winrm_investigate/)| None | Investigation | | [Internal Host WinRM Log4j Investigate](/playbooks/internal_host_winrm_log4j_investigate/)| None | Investigation | | [Internal Host WinRM Response](/playbooks/internal_host_winrm_response/)| None | Response | -| [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)| Investigation | -| [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)| Response | +| [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution]((/detection/curl_download_and_bash_execution/)[Wget Download and Bash Execution]((/detection/wget_download_and_bash_execution/)[Linux Java Spawning Shell]((/detection/linux_java_spawning_shell/)[Windows Java Spawning Shell]((/detection/windows_java_spawning_shell/)[Java Class File download by Java User Agent]((/detection/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports]((/detection/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt]((/detection/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection]((/detection/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic]((/detection/detect_outbound_ldap_traffic/)| Investigation | +| [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution]((/detection/curl_download_and_bash_execution/)[Wget Download and Bash Execution]((/detection/wget_download_and_bash_execution/)[Linux Java Spawning Shell]((/detection/linux_java_spawning_shell/)[Windows Java Spawning Shell]((/detection/windows_java_spawning_shell/)[Java Class File download by Java User Agent]((/detection/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports]((/detection/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt]((/detection/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection]((/detection/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic]((/detection/detect_outbound_ldap_traffic/)| Response | | [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation | | [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response | -| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response | +| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter]((/detection/conti_common_exec_parameter/)| Response | | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response | | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation | | [Risk Notable Import Data](/playbooks/risk_notable_import_data/)| None | Investigation | diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md index a29145b8d2..9f8755db0c 100644 --- a/docs/_pages/stories.md +++ b/docs/_pages/stories.md @@ -68,7 +68,7 @@ sidebar: | [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) | | [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | -| [Living Off The Land](living_off_the_land) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Privilege Escalation](/tags/#privilege-escalation) | +| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) | | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) | | [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) | | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) | diff --git a/docs/_playbooks/delete_detected_files.md b/docs/_playbooks/delete_detected_files.md index 63b2ec3b27..38f5735950 100644 --- a/docs/_playbooks/delete_detected_files.md +++ b/docs/_playbooks/delete_detected_files.md @@ -24,7 +24,7 @@ This playbook acts upon events where a file has been determined to be malicious #### Associated Detections -* [Executable File Written in Administrative SMB Share](//executable_file_written_in_administrative_smb_share/) +* [Executable File Written in Administrative SMB Share](/detection/executable_file_written_in_administrative_smb_share/) diff --git a/docs/_playbooks/log4j_investigate.md b/docs/_playbooks/log4j_investigate.md index b337ceb3eb..f14e01676f 100644 --- a/docs/_playbooks/log4j_investigate.md +++ b/docs/_playbooks/log4j_investigate.md @@ -24,14 +24,15 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can #### Associated Detections -* [Curl Download and Bash Execution](//curl_download_and_bash_execution/) -* [Java Class File download by Java User Agent](//java_class_file_download_by_java_user_agent/) -* [Linux Java Spawning Shell](//linux_java_spawning_shell/) -* [Outbound Network Connection from Java Using Default Ports](//outbound_network_connection_from_java_using_default_ports/) -* [Wget Download and Bash Execution](//wget_download_and_bash_execution/) -* [Detect Outbound LDAP Traffic](//detect_outbound_ldap_traffic/) -* [Log4Shell JNDI Payload Injection Attempt](//log4shell_jndi_payload_injection_attempt/) -* [Log4Shell JNDI Payload Injection with Outbound Connection](//log4shell_jndi_payload_injection_with_outbound_connection/) +* [Curl Download and Bash Execution](/detection/curl_download_and_bash_execution/) +* [Wget Download and Bash Execution](/detection/wget_download_and_bash_execution/) +* [Linux Java Spawning Shell](/detection/linux_java_spawning_shell/) +* [Windows Java Spawning Shell](/detection/windows_java_spawning_shell/) +* [Java Class File download by Java User Agent](/detection/java_class_file_download_by_java_user_agent/) +* [Outbound Network Connection from Java Using Default Ports](/detection/outbound_network_connection_from_java_using_default_ports/) +* [Log4Shell JNDI Payload Injection Attempt](/detection/log4shell_jndi_payload_injection_attempt/) +* [Log4Shell JNDI Payload Injection with Outbound Connection](/detection/log4shell_jndi_payload_injection_with_outbound_connection/) +* [Detect Outbound LDAP Traffic](/detection/detect_outbound_ldap_traffic/) diff --git a/docs/_playbooks/log4j_respond.md b/docs/_playbooks/log4j_respond.md index e781a71ad5..f00f194f1f 100644 --- a/docs/_playbooks/log4j_respond.md +++ b/docs/_playbooks/log4j_respond.md @@ -24,14 +24,15 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a #### Associated Detections -* [Curl Download and Bash Execution](//curl_download_and_bash_execution/) -* [Java Class File download by Java User Agent](//java_class_file_download_by_java_user_agent/) -* [Linux Java Spawning Shell](//linux_java_spawning_shell/) -* [Outbound Network Connection from Java Using Default Ports](//outbound_network_connection_from_java_using_default_ports/) -* [Wget Download and Bash Execution](//wget_download_and_bash_execution/) -* [Detect Outbound LDAP Traffic](//detect_outbound_ldap_traffic/) -* [Log4Shell JNDI Payload Injection Attempt](//log4shell_jndi_payload_injection_attempt/) -* [Log4Shell JNDI Payload Injection with Outbound Connection](//log4shell_jndi_payload_injection_with_outbound_connection/) +* [Curl Download and Bash Execution](/detection/curl_download_and_bash_execution/) +* [Wget Download and Bash Execution](/detection/wget_download_and_bash_execution/) +* [Linux Java Spawning Shell](/detection/linux_java_spawning_shell/) +* [Windows Java Spawning Shell](/detection/windows_java_spawning_shell/) +* [Java Class File download by Java User Agent](/detection/java_class_file_download_by_java_user_agent/) +* [Outbound Network Connection from Java Using Default Ports](/detection/outbound_network_connection_from_java_using_default_ports/) +* [Log4Shell JNDI Payload Injection Attempt](/detection/log4shell_jndi_payload_injection_attempt/) +* [Log4Shell JNDI Payload Injection with Outbound Connection](/detection/log4shell_jndi_payload_injection_with_outbound_connection/) +* [Detect Outbound LDAP Traffic](/detection/detect_outbound_ldap_traffic/) diff --git a/docs/_playbooks/ransomware_investigate_and_contain.md b/docs/_playbooks/ransomware_investigate_and_contain.md index f899706d0b..de4214097d 100644 --- a/docs/_playbooks/ransomware_investigate_and_contain.md +++ b/docs/_playbooks/ransomware_investigate_and_contain.md @@ -29,7 +29,7 @@ This playbook investigates and contains ransomware detected on endpoints. #### Associated Detections -* [Conti Common Exec parameter](//conti_common_exec_parameter/) +* [Conti Common Exec parameter](/detection/conti_common_exec_parameter/) diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md index adf0f93269..13e88bfe68 100644 --- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md +++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md @@ -16,7 +16,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,6 +25,7 @@ The search is used to detect systems that are still vulnerable to the Spectre an - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Vulnerabilities](https://docs.splunk.com/Documentation/CIM/latest/User/Vulnerabilities) + - **Last Updated**: 2017-01-07 - **Author**: David Dorsey, Splunk - **ID**: 354be8e0-32cd-4da0-8c47-796de13b60ea diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md index 370deff141..77db541995 100644 --- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md +++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ The search queries the authentication logs for assets that are categorized as ro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2017-09-12 - **Author**: Bhavin Patel, Splunk - **ID**: bce3ed7c-9b1f-42a0-abdf-d8b123a34836 diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md index bb42fe7c30..13ee1d05bb 100644 --- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search returns a list of hosts that have not successfully completed a backu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2017-09-12 - **Author**: David Dorsey, Splunk - **ID**: a34aae96-ccf8-4aef-952c-3ea214444440 diff --git a/docs/_posts/2017-09-12-identify_new_user_accounts.md b/docs/_posts/2017-09-12-identify_new_user_accounts.md index 73b851f297..1c42a5becd 100644 --- a/docs/_posts/2017-09-12-identify_new_user_accounts.md +++ b/docs/_posts/2017-09-12-identify_new_user_accounts.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This detection search will help profile user accounts in your environment by ide - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2017-09-12 - **Author**: Bhavin Patel, Splunk - **ID**: 475b9e27-17e4-46e2-b7e2-648221be3b89 diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md index 8e609e5e9e..5f5b08deef 100644 --- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md +++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search gives you the hosts where a backup was attempted and then failed. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2017-09-12 - **Author**: David Dorsey, Splunk - **ID**: a34aae96-ccf8-4aaa-952c-3ea21444444f diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md index 1089abeefa..5bb6c25e69 100644 --- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md +++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Sessions](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions) + - **Last Updated**: 2017-09-13 - **Author**: Bhavin Patel, Splunk - **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4 diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md index ece9bdddad..8f3da14f0b 100644 --- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md +++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search looks for Windows endpoints that have not generated an event indicat - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Updates](https://docs.splunk.com/Documentation/CIM/latest/User/Updates) + - **Last Updated**: 2017-09-15 - **Author**: Bhavin Patel, Splunk - **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md index d8708e020a..309c3f1e42 100644 --- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md +++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) + - **Last Updated**: 2017-09-19 - **Author**: David Dorsey, Splunk - **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8 diff --git a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md index 665f901bf7..1022ca1c15 100644 --- a/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md +++ b/docs/_posts/2017-09-19-open_redirect_in_splunk_web.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -23,7 +23,8 @@ This search allows you to look for evidence of exploitation for CVE-2016-4859, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2017-09-19 - **Author**: Bhavin Patel, Splunk - **ID**: d199fb99-2312-451a-9daa-e5efa6ed76a7 diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md index a5f3d68ac5..67c3810afb 100644 --- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md +++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2017-09-20 - **Author**: Bhavin Patel, Splunk - **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md index 43e9f3643a..a334f45f22 100644 --- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for specific GET or HEAD requests to web servers that are indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2017-09-23 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499e-9719-17243f982681 diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md index 21c36c4502..0529aa15c5 100644 --- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md +++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2017-09-23 - **Author**: Bhavin Patel, Splunk - **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md index f3f90ffa49..c9b1c1a70d 100644 --- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for DNS requests for faux domains similar to the domains that - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2017-09-23 - **Author**: David Dorsey, Splunk - **ID**: 24dd17b1-e2fb-4c31-878c-d4f746595bfa @@ -41,8 +42,8 @@ This search looks for DNS requests for faux domains similar to the domains that #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md index f1cb4383ab..bcee7b8f25 100644 --- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md +++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search looks for Web requests to faux domains similar to the one that you w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2017-09-23 - **Author**: David Dorsey, Splunk - **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301 @@ -43,9 +44,9 @@ This search looks for Web requests to faux domains similar to the one that you w #### Macros The SPL above uses the following Macros: +* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml) Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md index b01ea49cbb..ebe1019ad0 100644 --- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md +++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search looks for unusually long strings in the Content-Type http header tha - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2017-10-13 - **Author**: Bhavin Patel, Splunk - **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md index 756fa3cb9a..d611b6f1e0 100644 --- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md +++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change_Analysis](https://docs.splunk.com/Documentation/CIM/latest/User/ChangeAnalysis) + - **Last Updated**: 2017-11-27 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499f-9719-17a43f9826f5 diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md index be9ad9792b..1f5e7ffcb9 100644 --- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md +++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search looks for emails claiming to be sent from a domain similar to one th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) + - **Last Updated**: 2018-01-05 - **Author**: David Dorsey, Splunk - **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8 diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md index 964aa0bfe7..8bde8e0bec 100644 --- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md +++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-02-23 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362d6fd75 diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md index ef3e918304..99e94d058d 100644 --- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md +++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for EC2 instances being created with previously unseen AMIs. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-03-12 - **Author**: David Dorsey, Splunk - **ID**: 347ec301-601b-48b9-81aa-9ddf9c829dd3 diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md index 726612e54d..de88571d9c 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS provisioning activities from previously unseen cities. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 344a1778-0b25-490c-adb1-de8beddf59cd diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md index 33b81408e5..6b8fc9f6b3 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS provisioning activities from previously unseen countri - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md index 021cc2b1ed..e1884fc26e 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for AWS provisioning activities from previously unseen IP addr - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 42e15012-ac14-4801-94f4-f1acbe64880b diff --git a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md index 00eec36d1e..8795d2f462 100644 --- a/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md +++ b/docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS provisioning activities from previously unseen regions - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-03-16 - **Author**: David Dorsey, Splunk - **ID**: 7971d3df-da82-4648-a6e5-b5637bea5253 diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md index e869d5f243..a5626638f1 100644 --- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md +++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects new API calls that have either never been seen before or tha - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-04-16 - **Author**: Bhavin Patel, Splunk - **ID**: 22773e84-bac0-4595-b086-20d3f335b4f1 diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md index ed00f4f6ef..16a2bb253f 100644 --- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md +++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search will detect users creating spikes in API activity related to securit - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-04-18 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f1-e32372d4bd53 diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md index ef97e5fce1..e0161c2865 100644 --- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md +++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search will detect spike in blocked outbound network connections originatin - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-05-07 - **Author**: Bhavin Patel, Splunk - **ID**: d3fffa37-492f-487b-a35d-c60fcb2acf01 diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md index 97a07cc14d..f68cefe8d6 100644 --- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md +++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-05-17 - **Author**: Bhavin Patel, Splunk - **ID**: 4d46e8bd-4072-48e4-92db-0325889ef894 diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md index c82d8c7ca9..a237be6e55 100644 --- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md +++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search will detect users creating spikes in API activity related to network - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-05-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a1f1-e32372d4bd53 diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md index d9b0aee9a1..4975a74a3d 100644 --- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md +++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2018-06-01 - **Author**: Rico Valdez, Splunk - **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419 diff --git a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md index f28e5e461e..d6330ff9c8 100644 --- a/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md +++ b/docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -23,7 +23,8 @@ This search allows you to look for evidence of exploitation for CVE-2018-11409, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-06-14 - **Author**: David Dorsey, Splunk - **ID**: f6a26b7b-7e80-4963-a9a8-d836e7534ebd diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md index 63e11dba84..350c815ce2 100644 --- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md +++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-06-28 - **Author**: Bhavin Patel, Splunk - **ID**: e6f1bb1b-f441-492b-9126-902acda217da diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md index f897e5444b..5912689e09 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md +++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search is used to identify the creation of multiple user accounts using the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: bf1d7b5c-df2f-4249-a401-c09fdc221ddf diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md index 05ea9c88ca..a435e93cf7 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md +++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is used to examine web sessions to identify those where the clicks a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: 31337bbb-bc22-4752-b599-ef192df2dc7a diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md index d8503c9270..4489483556 100644 --- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md +++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search is used to identify user accounts that share a common password. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-10-08 - **Author**: Jim Apger, Splunk - **ID**: 31337a1a-53b9-4e05-96e9-55c934cb71d3 diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md index 180b6b9ee8..6f221760b2 100644 --- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md +++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for cloud compute instances being created with previously unse - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2018-10-12 - **Author**: David Dorsey, Splunk - **ID**: bc24922d-987c-4645-b288-f8c73ec194c4 diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md index 5657254d99..c4ec7193a2 100644 --- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks for the creation of WMI permanent event subscriptions. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-10-23 - **Author**: Rico Valdez, Splunk - **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d @@ -55,8 +56,8 @@ This search looks for the creation of WMI permanent event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md index e1ff7f6ae1..6b4b5b1926 100644 --- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md +++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks for the creation of WMI temporary event subscriptions. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-10-23 - **Author**: Rico Valdez, Splunk - **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 @@ -54,8 +55,8 @@ This search looks for the creation of WMI temporary event subscriptions. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md index 4d7cb6f5da..692a542af3 100644 --- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md +++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-11-02 - **Author**: Rico Valdez, Splunk - **ID**: 06a6fc63-a72d-41dc-8736-7e3dd9612116 diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md index 4ba9f16d13..40acea4acf 100644 --- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md +++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search detects users creating spikes in API activity related to deletion of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-11-27 - **Author**: Bhavin Patel, Splunk - **ID**: e733a326-59d2-446d-b8db-14a17151aa68 diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md index 92b76f915d..e07ca41a84 100644 --- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md +++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-03 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838 @@ -76,6 +77,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil #### Associated Analytic story * [Suspicious WMI Use](/stories/suspicious_wmi_use) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md index 96b0c05747..3677c317ec 100644 --- a/docs/_posts/2018-12-03-usn_journal_deletion.md +++ b/docs/_posts/2018-12-03-usn_journal_deletion.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-03 - **Author**: David Dorsey, Splunk - **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3 diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md index c21f771c79..b6a974b408 100644 --- a/docs/_posts/2018-12-06-suspicious_java_classes.md +++ b/docs/_posts/2018-12-06-suspicious_java_classes.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search looks for suspicious Java classes that are often used to exploit rem - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2018-12-06 - **Author**: Jose Hernandez, Splunk - **ID**: 6ed33786-5e87-4f55-b62c-cb5f1168b831 diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md index d83b77f8a1..0014b6c7bc 100644 --- a/docs/_posts/2018-12-14-file_with_samsam_extension.md +++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ The search looks for file writes with extensions consistent with a SamSam ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-14 - **Author**: Rico Valdez, Splunk - **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md index fa43fbd688..aefe5b1492 100644 --- a/docs/_posts/2018-12-14-samsam_test_file_write.md +++ b/docs/_posts/2018-12-14-samsam_test_file_write.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The search looks for a file named "test.txt" written to the windows system direc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2018-12-14 - **Author**: Rico Valdez, Splunk - **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md index ec85edc9bb..d70ff53eed 100644 --- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md +++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search looks for processes in an MacOS system that is tapping keyboard even - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-01-25 - **Author**: Jose Hernandez, Splunk - **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md index 400e12f9f1..b21e41017c 100644 --- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md +++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for ColdRoot events from the osx-attacks osquery pack. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-01-29 - **Author**: Rico Valdez, Splunk - **ID**: a6fffe5e-05c3-4c04-badc-887607fbb8dc diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md index 7801749ce3..b4dbd5a634 100644 --- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md +++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for PowerShell requesting privileges consistent with credentia - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-02-27 - **Author**: Rico Valdez, Splunk - **ID**: 98917be2-bfc8-475a-8618-a9bb06575188 @@ -53,8 +54,8 @@ This search looks for PowerShell requesting privileges consistent with credentia #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_mimikatz_via_powershell_and_eventcode_4703_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md index a097081252..ab92fd440f 100644 --- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md +++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The search looks for command-line arguments used to hide a file or directory usi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2019-02-27 - **Author**: Bhavin Patel, Splunk - **ID**: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459 diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md index 7b887af0b9..f356bb42e9 100644 --- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md +++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for suspicious processes on all systems labeled as web servers - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2019-04-01 - **Author**: David Dorsey, Splunk - **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9 diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md index aa95f9b0b1..c4afe23271 100644 --- a/docs/_posts/2019-04-25-suspicious_file_write.md +++ b/docs/_posts/2019-04-25-suspicious_file_write.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ The search looks for files created with names that have been linked to malicious - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-04-25 - **Author**: Rico Valdez, Splunk - **ID**: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 @@ -41,9 +42,9 @@ The search looks for files created with names that have been linked to malicious #### Macros The SPL above uses the following Macros: +* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml) Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md index f0a08d34c7..1ee6c7a7e1 100644 --- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md +++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ Command lines that are extremely long may be indicative of malicious activity on - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-05-08 - **Author**: Rico Valdez, Splunk - **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941 diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md index 3aa747b905..76a6a1aab2 100644 --- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md +++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for applications on the endpoint that you have marked as prohi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2019-10-11 - **Author**: David Dorsey, Splunk - **ID**: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 @@ -43,8 +44,8 @@ This search looks for applications on the endpoint that you have marked as prohi #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml) Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md index 12410cda80..e44de96439 100644 --- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md +++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for reading lsass memory consistent with credential dumping. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-12-03 - **Author**: Patrick Bareiss, Splunk - **ID**: 2c365e57-4414-4540-8dc0-73ab10729996 diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md index 6c5bc93ee0..33a0d490ea 100644 --- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md +++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-12-03 - **Author**: Patrick Bareiss, Splunk - **ID**: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md index 0ec7797379..d0dd8213a1 100644 --- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md +++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ Detect memory dumping of the LSASS process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md index 89c7a8a070..e9bec5ab10 100644 --- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md +++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ Detect remote thread creation into LSASS consistent with credential dumping. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 67d4dbef-9564-4699-8da8-03a151529edc diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md index dede3e689d..7aaa26ddda 100644 --- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md +++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2019-12-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 56ef054c-76ef-45f9-af4a-a634695dcd65 diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md index 5462bc3d62..ff88351c6f 100644 --- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md +++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2019-12-10 - **Author**: Patrick Bareiss, Splunk - **ID**: eb120f5f-b879-4a63-97c1-93352b5df844 diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md index 817808f653..44445649f8 100644 --- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md +++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search allows you to identify DNS requests that are unusually large for the - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-01-22 - **Author**: Rico Valdez, Splunk - **ID**: 85fbcfe8-9718-4911-adf6-7000d077a3a9 diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md index dfd60adb67..71429e974f 100644 --- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md +++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to detect a suspicious registry modification to implement auto ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122 diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md index 4391fa7d1d..d6e5d5d545 100644 --- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md +++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for registry activity associated with modifications to the reg - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-01-28 - **Author**: Bhavin Patel, Teoderick Contreras, Splunk - **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md index c2aca7461f..2a4486c619 100644 --- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md +++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for registry activity associated with application compatibilit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-01-28 - **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md index da2665baed..229d2c86a0 100644 --- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md +++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: d71efbf6-da63-11eb-8c6e-acde48001122 diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md index 4455a95461..d8d8176aca 100644 --- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md +++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a suspicious modification of registry that may related - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122 diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md index a72658ee9c..c32bea13d8 100644 --- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md +++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a suspicious modification of registry related to UAC by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 8b5901bc-da63-11eb-be43-acde48001122 diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md index 9733926abe..b6edc36201 100644 --- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md +++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-02-03 - **Author**: Michael Haag, Splunk - **ID**: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md index 55eada654c..f7c68bfc41 100644 --- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for EC2 instances being created with previously unseen instanc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-02-07 - **Author**: David Dorsey, Splunk - **ID**: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md index 8d23b3f59c..eecd5c170d 100644 --- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md +++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search looks for processes referencing the plist files that determine which - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-02-07 - **Author**: Jamie Windley, Splunk - **ID**: 40bb64f9-f619-4e3d-8732-328d40377c4b diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md index 4ed1734b1c..51aa7a1eef 100644 --- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md +++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search show information on uploaded containers including source user, accou - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-02-20 - **Author**: Rod Soto, Rico Valdez, Splunk - **ID**: 4f00ca88-e766-4605-ac65-ae51c9fd185b diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md index 039c1aba96..818ac61fdb 100644 --- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md +++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This searches show information on uploaded containers including source user, ima - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-02-20 - **Author**: Rod Soto, Rico Valdez, Splunk - **ID**: f0f70b40-f7ad-489d-9905-23d149da8099 diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md index 2c824fd4a0..9d6e30438a 100644 --- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md +++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Detect the usage of comsvcs.dll for dumping the lsass process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-02-21 - **Author**: Patrick Bareiss, Splunk - **ID**: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 @@ -56,9 +57,9 @@ Detect the usage of comsvcs.dll for dumping the lsass process. #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -87,6 +88,7 @@ None identified. * [Credential Dumping](/stories/credential_dumping) * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) * [HAFNIUM Group](/stories/hafnium_group) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md index 13f0442a3f..60407739d1 100644 --- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md +++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search monitors for remote modifications to registry keys. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-03-02 - **Author**: Bhavin Patel, Splunk - **ID**: c9f4b923-f8af-4155-b697-1354f5dcbc5e diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md index a8067d4b79..84010add1e 100644 --- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md +++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md @@ -21,7 +21,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for child processes of spoolsv.exe. This activity is associate - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Splunk - **ID**: aa0c4aeb-5b18-41c4-8c07-f1442d7599df diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md index 0dc1bfa7a4..a049ab04bc 100644 --- a/docs/_posts/2020-03-16-detect_rare_executables.md +++ b/docs/_posts/2020-03-16-detect_rare_executables.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ This search will return a table of rare processes, the names of the systems runn - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-03-16 - **Author**: Bhavin Patel, Splunk - **ID**: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac @@ -50,9 +51,9 @@ This search will return a table of rare processes, the names of the systems runn #### Macros The SPL above uses the following Macros: +* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml) Note that `detect_rare_executables_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md index 12a8906a26..21e2aca51c 100644 --- a/docs/_posts/2020-03-16-process_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: 24869767-8579-485d-9a4f-d9ddfd8f0cac diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md index 9bfaac2979..261fc2113c 100644 --- a/docs/_posts/2020-03-16-script_execution_via_wmi.md +++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for scripts launched via WMI. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-03-16 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: aa73f80d-d728-4077-b226-81ea0c8be589 diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md index 36755d5977..79aff1eceb 100644 --- a/docs/_posts/2020-03-16-spike_in_file_writes.md +++ b/docs/_posts/2020-03-16-spike_in_file_writes.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ The search looks for a sharp increase in the number of files written to a partic - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-03-16 - **Author**: David Dorsey, Splunk - **ID**: fdb0f805-74e4-4539-8c00-618927333aae diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md index 0556f156b4..a92893c22e 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: 294c4686-63dd-4fe6-93a2-ca807626704a diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md index 2a393d06c6..a974b99e47 100644 --- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md +++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search provides detection information on unauthenticated requests against K - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002 diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md index 5cd2c9d085..0b27ab0d12 100644 --- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md +++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-04-15 - **Author**: Rod Soto, Splunk - **ID**: db5957ec-0144-4c56-b512-9dccbe7a2d26 @@ -51,8 +52,8 @@ This search provides information of unauthenticated requests via user agent, and #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `gcp_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md index 3f77fd6656..768a92d242 100644 --- a/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md +++ b/docs/_posts/2020-05-19-kubernetes_azure_scan_fingerprint.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search provides information of unauthenticated requests via source IP user - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-19 - **Author**: Rod Soto, Splunk - **ID**: c5e5bd5c-1013-4841-8b23-e7b3253c840a diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md index 9389808956..7be87684a1 100644 --- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md +++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-05-20 - **Author**: David Dorsey, Splunk - **ID**: e91bd102-d630-4e76-ab73-7e3ba22c5961 @@ -55,9 +56,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no #### Macros The SPL above uses the following Macros: +* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml) Note that `first_time_seen_child_process_of_zoom_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md index 4df0a67e47..ae95fc1e8a 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_object_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 1bba382b-07fd-4ffa-b390-8002739b76e8 diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md index 96566f4eeb..18a3ed6a92 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_sensitive_role_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: f27349e5-1641-4f6a-9e68-30402be0ad4c diff --git a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md index f32e398dc1..a1e334a73d 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 019690d7-420f-4da0-b320-f27b09961514 diff --git a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md index 1add6fc6a0..395ee979aa 100644 --- a/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md +++ b/docs/_posts/2020-05-20-kubernetes_azure_pod_scan_fingerprint.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information of unauthenticated requests via source IP user - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-20 - **Author**: Rod Soto, Splunk - **ID**: 86aad3e0-732f-4f66-bbbc-70df448e461d diff --git a/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md new file mode 100644 index 0000000000..f9cd988580 --- /dev/null +++ b/docs/_posts/2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md @@ -0,0 +1,85 @@ +--- +title: "Kubernetes Azure active service accounts by pod namespace" +excerpt: "" +categories: + - Deprecated +last_modified_at: 2020-05-26 +toc: true +toc_label: "" +tags: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb + +- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + + +- **Last Updated**: 2020-05-26 +- **Author**: Rod Soto, Splunk +- **ID**: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 + +#### Search + +``` +`kubernetes_azure` category=kube-audit +| spath input=properties.log +| search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow +| table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace +| top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace +|`kubernetes_azure_active_service_accounts_by_pod_namespace_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [kubernetes_azure](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_azure.yml) + +Note that `kubernetes_azure_active_service_accounts_by_pod_namespace_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time + + +#### How To Implement +You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics + +#### Known False Positives +Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness. + +#### Associated Analytic story +* [Kubernetes Sensitive Role Activity](/stories/kubernetes_sensitive_role_activity) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | tbd | + + + + +#### Reference + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md index 17a5aab58b..24c0a7eff0 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-26 - **Author**: Rod Soto, Splunk - **ID**: 47af7d20-0607-4079-97d7-7a29af58b54e diff --git a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md index d1dee01231..35b59e1276 100644 --- a/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on rare Kubectl calls with IP, verb namespace a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-05-26 - **Author**: Rod Soto, Splunk - **ID**: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md index a3596612d2..55ab43e0f5 100644 --- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md +++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for AssumeRole events where an IAM role in a different account - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2020-05-28 - **Author**: Rico Valdez, Splunk - **ID**: 21193641-cb96-4a2c-a707-d9b9a7f7792b diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md index 6229c626fc..b40d06a56c 100644 --- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md +++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2020-05-28 - **Author**: Rico Valdez, Splunk - **ID**: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 diff --git a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md index 19854838f6..d9e5c56ab1 100644 --- a/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md +++ b/docs/_posts/2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 7f227943-2196-4d4d-8d6a-ac8cb308e61c diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md index 2aebeb7958..ce40024bb8 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes service accounts,accessing pods b - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md index 611c8984de..2c44bec2af 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md index d6fa8571e7..3a0135a5f2 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_sensitive_role_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: b6013a7b-85e0-4a45-b051-10b252d69569 diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md index 558e46e6ff..4b8c2902a1 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: a6959c57-fa8f-4277-bb86-7c32fba579d5 diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md index 1fc9ab49c7..7f367b77da 100644 --- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 042a3d32-8318-4763-9679-09db2644a8f2 diff --git a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md index 3df177dbe0..8a29907893 100644 --- a/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md +++ b/docs/_posts/2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes service accounts with failure or - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-06-23 - **Author**: Rod Soto, Splunk - **ID**: 7094808d-432a-48e7-bb3c-77e96c894f3b diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md index 7c01f89571..9f0ab55a0d 100644 --- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md +++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The detection Detect Path Interception By Creation Of program exe is detecting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-03 - **Author**: Patrick Bareiss, Splunk - **ID**: cbef820c-e1ff-407f-887f-0a9240a2d477 diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md index be4324dba7..61bc46fad6 100644 --- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md +++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search detects accounts that were created and deleted in a short time perio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) + - **Last Updated**: 2020-07-06 - **Author**: David Dorsey, Splunk - **ID**: b25f6f62-0782-43c1-b403-083231ffd97d diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md index 6b432a8821..ab412329c3 100644 --- a/docs/_posts/2020-07-06-windows_event_log_cleared.md +++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-06 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: ad517544-aff9-4c96-bd99-d6eb43bfbb6a @@ -54,9 +55,9 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `windows_event_log_cleared_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md index 83ca12cc39..09f82206e6 100644 --- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md +++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for network traffic on TCP/3389, the default port used by remo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-07 - **Author**: David Dorsey, Splunk - **ID**: 272b8407-842d-4b3d-bead-a704584003d3 diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md index f515333830..9f641493c7 100644 --- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md +++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for newly created accounts that have been elevated to local ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-08 - **Author**: David Dorsey, Splunk - **ID**: b25f6f62-0712-43c1-b203-083231ffd97d @@ -56,8 +57,8 @@ This search looks for newly created accounts that have been elevated to local ad #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_new_local_admin_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md index 17d9261e2e..eef2483788 100644 --- a/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md +++ b/docs/_posts/2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes service accounts,accessing pods b - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-10 - **Author**: Rod Soto, Splunk - **ID**: 7f5c2779-88a0-4824-9caa-0f606c8f260f diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md index f91179a107..a5ac453246 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes RBAC authorizations by accounts, - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: 99487de3-7192-4b41-939d-fbe9acfb1340 diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md index 1b3c15d5d1..99bdfea5c5 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: bdb6d596-86a0-4aba-8369-418ae8b9963a diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md index 0e6c337cae..5cdf527055 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on Kubernetes accounts accessing sensitve objec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: a46923f6-36b9-4806-a681-31f314907c30 diff --git a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md index f287d94fc8..445921b118 100644 --- a/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md +++ b/docs/_posts/2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search provides information on anonymous Kubectl calls with IP, verb namesp - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-11 - **Author**: Rod Soto, Splunk - **ID**: a5bed417-070a-41f2-a1e4-82b6aa281557 diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md index 7049254eee..38fe9489e4 100644 --- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md +++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search provides information of unauthenticated requests via user agent, and - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-17 - **Author**: Rod Soto, Splunk - **ID**: 19b53215-4a16-405b-8087-9e6acf619842 diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md index 0a37371fe3..e0809c9729 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user successfully launches a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md index 608449594f..26fcda1342 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user successfully launches a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Jason Brewer, Splunk - **ID**: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md index 22924a0c0b..a6673a6d64 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where an abnormally high number of i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 8d301246-fccf-45e2-a8e7-3655fd14379c diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md index d6eda64f20..71f213dc1c 100644 --- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md +++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user successfully terminates - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Jason Brewer, Splunk - **ID**: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md index bb6a8f9b01..913fe61a7e 100644 --- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md +++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for attempts to stop security-related services on the endpoint - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: c8e349c6-b97c-486e-8949-bd7bcd1f3910 @@ -58,8 +59,8 @@ This search looks for attempts to stop security-related services on the endpoint #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `attempt_to_stop_security_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md index 08667d0f3a..03fc8f599e 100644 --- a/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md +++ b/docs/_posts/2020-07-21-clients_connecting_to_multiple_dns_servers.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search allows you to identify the endpoints that have connected to more tha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 74ec6f18-604b-4202-a567-86b2066be3ce diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md index f607858184..15845099a2 100644 --- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md +++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d4bd55 diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md index e2abee3728..9d26a31b71 100644 --- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md +++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for DNS requests for phishing domains that are leveraging Evil - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 24dd17b1-e2fb-4c31-878c-d4f226595bfa @@ -62,14 +63,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil #### Macros The SPL above uses the following Macros: -* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml) * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) -* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) -* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml) +* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml) +* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml) +* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml) +* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md index d0fc3a03da..f7f28ab6d9 100644 --- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md +++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search detects user accounts that have been locked out a relatively high nu - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 95a7f9a5-6096-437e-a19e-86f42ac609bd diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md index e73b910ff9..40a7662317 100644 --- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md +++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is used to detect attempts to use DNS tunneling, by calculating the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 05437c07-62f5-452e-afdc-04dd44815bb9 diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md index 7e9e91b6f5..df080df3c3 100644 --- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md +++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75 diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md index 3a2daf297f..1fdb31776a 100644 --- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md +++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for outbound SMB connections made by hosts within your network - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Stuart Hopkins from Splunk - **ID**: 1bed7774-304a-4e8f-9d72-d80e45ff492b diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md index 61ab09c214..64510a081a 100644 --- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md +++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for execution of process `outlook.exe` where the process is wr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-4822-b1e4-16ae10145893 diff --git a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md index 654dd9105c..32f34d7548 100644 --- a/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md +++ b/docs/_posts/2020-07-21-detect_spike_in_aws_api_activity.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search will detect users creating spikes of API activity in your AWS enviro - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d32362d4bd55 diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md index 6542afe296..d52dbb470d 100644 --- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md +++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for the execution of the cscript.exe or wscript.exe processes, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Mauricio Velazco, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162039e diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md index e304bac90b..2532f7466b 100644 --- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md +++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for web connections to dynamic DNS providers. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 134da869-e264-4a8f-8d7e-fcd01c18f301 @@ -51,9 +52,9 @@ This search looks for web connections to dynamic DNS providers. #### Macros The SPL above uses the following Macros: +* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml) Note that `detect_web_traffic_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md index 484dde7b7c..9905b1d349 100644 --- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md +++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md @@ -21,7 +21,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for specific command-line arguments that may indicate the exec - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 3d8d201c-aa03-422d-b0ee-2e5ecf9718c0 diff --git a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md index d29933ab1c..3eb8b2efc4 100644 --- a/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md +++ b/docs/_posts/2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search will detect DNS requests resolved by unauthorized DNS servers. Legit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 diff --git a/docs/_posts/2020-07-21-dns_record_changed.md b/docs/_posts/2020-07-21-dns_record_changed.md index 56215b21d4..130b17effa 100644 --- a/docs/_posts/2020-07-21-dns_record_changed.md +++ b/docs/_posts/2020-07-21-dns_record_changed.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The search takes the DNS records and their answers results of the discovered_dns - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: Jose Hernandez, Splunk - **ID**: 44d3a43e-dcd5-49f7-8356-5209bb369065 diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md index 8bba12b5ac..0c4798507a 100644 --- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for EC2 instances being modified by users who have not previou - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 56f91724-cf3f-4666-84e1-e3712fb41e76 @@ -63,8 +64,8 @@ This search looks for EC2 instances being modified by users who have not previou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that `ec2_instance_modified_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md index 62555ec34b..c6a34f5efb 100644 --- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md +++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for EC2 instances being created by users who have not created - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 22773e84-bac0-4595-b086-20d3f735b4f1 diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md index 07d0999369..b0db0ed787 100644 --- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md +++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The search looks at the change-analysis data model and detects email files creat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 8d52cf03-ba25-4101-aa78-07994aed4f74 diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md index b47589a33d..39d8a5065f 100644 --- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md +++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for an increase of data transfers from your email server to yo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556378 diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md index 6e68ccb035..f4ba929683 100644 --- a/docs/_posts/2020-07-21-excessive_dns_failures.md +++ b/docs/_posts/2020-07-21-excessive_dns_failures.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search identifies DNS query failures by counting the number of DNS response - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499e-9719-17243f9826f1 diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md index 77646a863d..401259a350 100644 --- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md +++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for command-line arguments that use a `/c` parameter to execut - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: a1b6e73f-98d5-470f-99ac-77aacd578473 diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md index a86970b407..c9526db45b 100644 --- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md +++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for the first and last time a Windows service is seen running - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 823136f2-d755-4b6d-ae04-372b486a5808 @@ -58,8 +59,8 @@ This search looks for the first and last time a Windows service is seen running #### Macros The SPL above uses the following Macros: -* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml) +* [previously_seen_windows_services_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_windows_services_window.yml) Note that `first_time_seen_running_windows_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md index b71164fea8..4f1df7ade7 100644 --- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md +++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md index 3a7d85966b..98bb3a2a99 100644 --- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md +++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for an increase of data transfers from your email server to yo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b556368 diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md index 971b69eef5..73198be5ba 100644 --- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md +++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for PowerShell processes started with parameters used to bypas - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Mauricio Velazco, Splunk - **ID**: 9be56c82-b1cc-4318-87eb-d138afaaca39 @@ -56,9 +57,9 @@ This search looks for PowerShell processes started with parameters used to bypas #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `malicious_powershell_process_-_execution_policy_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md index 7c24935997..28d99548ef 100644 --- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md +++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md @@ -28,7 +28,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ This search detects Okta login failures due to bad credentials for multiple user - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 19cba45f-cad3-4032-8911-0c09e0444552 @@ -64,8 +65,8 @@ This search detects Okta login failures due to bad credentials for multiple user #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md index 4e95568f29..b63b9d82bb 100644 --- a/docs/_posts/2020-07-21-okta_account_lockout_events.md +++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md @@ -28,7 +28,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ Detect Okta user lockout events - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 62b70968-a0a5-4724-8ac4-67871e6f544d diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md index f8f125b92d..a878ecd1a7 100644 --- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md +++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md @@ -28,7 +28,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ Detect failed Okta SSO events - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 371a6545-2618-4032-ad84-93386b8698c5 @@ -62,8 +63,8 @@ Detect failed Okta SSO events #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `okta_failed_sso_attempts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md index 03b77f64e5..a6330a178a 100644 --- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md +++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md @@ -28,7 +28,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ This search detects logins from the same user from different cities in a 24 hour - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8 @@ -63,8 +64,8 @@ This search detects logins from the same user from different cities in a 24 hour #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `okta_user_logins_from_multiple_cities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md index c16aede44c..54184b6ed2 100644 --- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md +++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ Microsoft Windows contains accessibility features that can be launched with a ke - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md index 56962e879a..e61a4a521f 100644 --- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md +++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for network traffic defined by port and transport layer protoc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: ce5a0962-849f-4720-a678-753fe6674479 diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md index 20d6c37afb..4135135727 100644 --- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md +++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for network traffic on common ports where a higher layer proto - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: 54dc1265-2f74-4b6d-b30d-49eb506a31b3 diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md index bb37fb25ae..8537e4341b 100644 --- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md +++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for RDP application network traffic and filters any source/des - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-21 - **Author**: Jose Hernandez, Splunk - **ID**: a98727cc-286b-4ff2-b898-41df64695923 diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md index 0bc4cdda0e..1912ab8e39 100644 --- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md +++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for the remote desktop process mstsc.exe running on systems up - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-21 - **Author**: David Dorsey, Splunk - **ID**: f5939373-8054-40ad-8c64-cec478a22a4a diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md index f5369ab881..cac51fb601 100644 --- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md +++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for arguments to sc.exe indicating the creation or modificatio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-21 - **Author**: Rico Valdez, Splunk - **ID**: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md index 944bfd8130..1a574ac55e 100644 --- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md +++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md index c23663e857..fe8bc0fef9 100644 --- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md +++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search looks for long URLs that have several SQL commands visible within th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2020-07-21 - **Author**: Bhavin Patel, Splunk - **ID**: e0aad4cf-0790-423b-8328-7564d0d938f9 diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md index 5604752050..5b46863348 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for spikes in the number of Server Message Block (SMB) traffic - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 7f5fb3e1-4209-4914-90db-0ec21b936378 diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md index 70313f634a..3bfb0cd54b 100644 --- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md +++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search uses the Machine Learning Toolkit (MLTK) to identify spikes in the n - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: d25773ba-9ad8-48d1-858e-07ad0bbeb828 diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md index 963b85013d..d806eb03eb 100644 --- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md +++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,7 +26,8 @@ This search looks for changes to registry values that control Windows file assoc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: 1b989a0e-0129-4446-a695-f193a5b746fc diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md index e0c6533177..5e325f0a4c 100644 --- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md +++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This detection looks for emails that are suspicious because of their sender, dom - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [UEBA](https://docs.splunk.com/Documentation/CIM/latest/User/UEBA) + - **Last Updated**: 2020-07-22 - **Author**: Bhavin Patel, Splunk - **ID**: 56e877a6-1455-4479-ad16-0550dc1e33f8 diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md index 1aa582046e..4367b775d0 100644 --- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md +++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for emails that have attachments with suspicious file extensio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email) + - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084 @@ -59,9 +60,9 @@ This search looks for emails that have attachments with suspicious file extensio #### Macros The SPL above uses the following Macros: +* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml) Note that `suspicious_email_attachment_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md index fb216e2876..e581f47272 100644 --- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md +++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for reg.exe being launched from a command prompt not started b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: a6b3ab4e-dd77-4213-95fa-fc94701995e0 diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md index ce0864f416..de2ae755ee 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search detects writes to the 'System Volume Information' folder by somethin - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md index 4c27c493e5..25e4653508 100644 --- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md +++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search detects writes to the recycle bin by a process other than explorer.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-22 - **Author**: Rico Valdez, Splunk - **ID**: b5541828-8ffd-4070-9d95-b3da4de924cb diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md index c939c86ea3..37da246a1a 100644 --- a/docs/_posts/2020-07-22-tor_traffic.md +++ b/docs/_posts/2020-07-22-tor_traffic.md @@ -23,7 +23,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search looks for network traffic identified as The Onion Router (TOR), a be - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: ea688274-9c06-4473-b951-e4cb7a5d7a45 diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md index b0e5910d1d..c9a2a1564a 100644 --- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md +++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for applications on the endpoint that you have marked as uncom - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-07-22 - **Author**: David Dorsey, Splunk - **ID**: 29ccce64-a10c-4389-a45f-337cb29ba1f7 @@ -52,8 +53,8 @@ This search looks for applications on the endpoint that you have marked as uncom #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `uncommon_processes_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md index 361e494373..fbcfcc12d1 100644 --- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md +++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Attackers often disable security tools to avoid detection. This search looks for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-07-22 - **Author**: Bhavin Patel, Splunk - **ID**: e5928ff3-23eb-4d8b-b8a4-dcbc844fdfbe diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md index 2e662c6b9a..4ce631c0a2 100644 --- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md +++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search provides detection of an user attaching itself to a different role t - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 88fc31dd-f331-448c-9856-d3d51dd5d3a1 diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md index e3881400ee..87ad85d0fa 100644 --- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search provides detection of accounts creating permanent keys. Permanent ke - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md index fca67a4222..20b5709870 100644 --- a/docs/_posts/2020-07-27-aws_detect_role_creation.md +++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search provides detection of role creation by IAM users. Role creation is a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 5f04081e-ddee-4353-afe4-504f288de9ad diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md index cad78c02bd..5cf3cdc3f0 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search provides detection of suspicious use of sts:AssumeRole. These tokens - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 8e565314-b6a2-46d8-9f05-1a34a176a662 diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md index 623fc7ec78..a3c9a81e39 100644 --- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md +++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides detection of suspicious use of sts:GetSessionToken. These t - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-27 - **Author**: Rod Soto, Splunk - **ID**: 85d7b35f-b8b5-4b01-916f-29b81e7a0551 diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md index 0dffd18c23..6a5aa66c7c 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects SIGRed via Splunk Stream. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-07-28 - **Author**: Shannon Davis, Splunk - **ID**: babd8d10-d073-11ea-87d0-0242ac130003 @@ -57,8 +58,8 @@ This search detects SIGRed via Splunk Stream. #### Macros The SPL above uses the following Macros: -* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) * [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml) +* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml) Note that `detect_windows_dns_sigred_via_splunk_stream_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md index 4cd38950bd..c347f574bc 100644 --- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md +++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md @@ -21,7 +21,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search detects SIGRed via Zeek DNS and Zeek Conn data. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2020-07-28 - **Author**: Shannon Davis, Splunk - **ID**: c5c622e4-d073-11ea-87d0-0242ac130003 diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md index 97102544f8..261a7c6cee 100644 --- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md +++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search looks for cloud instances being modified by users who have not previ - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-07-29 - **Author**: Rico Valdez, Splunk - **ID**: 7fb15084-b14e-405a-bd61-a6de15a40722 diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md index 851c86ee52..f71b3f49da 100644 --- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md +++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traff - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-08-02 - **Author**: Shannon Davis, Splunk - **ID**: 810e4dbc-d46e-11ea-87d0-0242ac130003 diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md index 5d4b9a5823..55ddb83e5e 100644 --- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md +++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks for GCP PubSub events where a user has created an open/public - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-08-05 - **Author**: Shannon Davis, Splunk - **ID**: f6ea3466-d6bb-11ea-87d0-0242ac130003 diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md index ad5c098667..46bb91f84b 100644 --- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md +++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks at GCP Storage bucket-access logs and detects new or previousl - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-08-10 - **Author**: Shannon Davis, Splunk - **ID**: ccc3246a-daa1-11ea-87d0-0242ac130022 diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md index 1c531ad91d..d09822c16d 100644 --- a/docs/_posts/2020-08-11-detect_arp_poisoning.md +++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md @@ -30,7 +30,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,7 +38,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-08-11 - **Author**: Mikael Bjerkeland, Splunk - **ID**: b44bebd6-bd39-467b-9321-73971bcd7aac @@ -69,8 +70,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_arp_poisoning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md index 11d63f38a3..678ffae041 100644 --- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md +++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md @@ -26,7 +26,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,7 +34,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-08-11 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 6e1ada88-7a0d-4ac1-92c6-03d354686079 @@ -62,8 +63,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_rogue_dhcp_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md index 1d5433109d..fa07cf6219 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for cloud provisioning activities from previously unseen IP ad - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-08-16 - **Author**: Rico Valdez, Splunk - **ID**: f86a8ec9-b042-45eb-92f4-e9ed1d781078 diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md index a0cf0b1513..497d4a7364 100644 --- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md +++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for cloud provisioning activities from previously unseen regio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-08-16 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: 5aba1860-9617-4af9-b19d-aecac16fe4f2 diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md index 9db1adb898..45646fdb13 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md @@ -29,7 +29,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ This search finds for the number successfully destroyed cloud instances for ever - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) + - **Last Updated**: 2020-08-21 - **Author**: David Dorsey, Splunk - **ID**: ef629fc9-1583-4590-b62a-f2247fbf7bbf diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md index 94d2e104c8..9a9cf0252d 100644 --- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md +++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md @@ -29,7 +29,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ This search finds for the number successfully created cloud instances for every - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) + - **Last Updated**: 2020-08-21 - **Author**: David Dorsey, Splunk - **ID**: f2361e9f-3928-496c-a556-120cd4223a65 diff --git a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md index ddd119d9e7..3d434cfc87 100644 --- a/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md +++ b/docs/_posts/2020-09-01-gcp_detect_oauth_token_abuse.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides detection of possible GCP Oauth token abuse. GCP Oauth toke - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-09-01 - **Author**: Rod Soto, Splunk - **ID**: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md index 8d89a2d964..3eb21dff3d 100644 --- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md +++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks at cloud-infrastructure events where an instance is created in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-02 - **Author**: David Dorsey, Splunk - **ID**: fa4089e2-50e3-40f7-8469-d2cc1564ca59 diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md index c7cb6481b5..87c126f76f 100644 --- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md +++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for new commands from each user role. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-04 - **Author**: David Dorsey, Splunk - **ID**: 2181ad1f-1e73-4d0c-9780-e8880482a08f diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md index 8ac44cd7bf..84c33540ab 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search will detect a spike in the number of API calls made to your cloud in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-07 - **Author**: David Dorsey, Splunk - **ID**: 0840ddf1-8c89-46ff-b730-c8d6722478c0 diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md index f4bfd9fd10..96347e13a3 100644 --- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md +++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search will detect a spike in the number of API calls made to your cloud in - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-07 - **Author**: David Dorsey, Splunk - **ID**: d4dfb7f3-7a37-498a-b5df-f19334e871af diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md index 72976b2dcd..a919c8823c 100644 --- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md +++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-09-08 - **Author**: Peter Gael, Splunk - **ID**: 021abc51-1862-41dd-ad43-43c739c0a983 diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md index a842431eeb..1cf9674336 100644 --- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md +++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ Find EC2 instances being created with previously unseen instance types. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-09-12 - **Author**: David Dorsey, Splunk - **ID**: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md index 6dd647489d..c21a8f2b0d 100644 --- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md +++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vul - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-09-15 - **Author**: Shannon Davis, Splunk - **ID**: bf7a06ec-f703-11ea-adc1-0242ac120002 diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md index e2231710be..a73dd7eae2 100644 --- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md +++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for the creation or deletion of hidden shares using net.exe. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-09-16 - **Author**: Bhavin Patel, Splunk - **ID**: 743a322c-9a68-4a0f-9c17-85d9cce2a27c @@ -57,8 +58,8 @@ This search looks for the creation or deletion of hidden shares using net.exe. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `create_or_delete_windows_shares_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md index d8bcbe8bfa..b1f25c09cf 100644 --- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md +++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An ac - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-09-18 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 1400624a-d42d-484d-8843-e6753e6e3645 diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md index 7112716a73..8ba257a7ab 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md index 3576c911c6..bf9a109e59 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 67bd3def-c41c-4bf6-837b-ae196b4257c6 diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md index d6a6c7cab9..a856b7bfe3 100644 --- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md +++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication) + - **Last Updated**: 2020-10-07 - **Author**: Bhavin Patel, Splunk - **ID**: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md index 3812a53656..f3f09de893 100644 --- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md +++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search provides detection of GCPloit exploitation framework. This framework - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-08 - **Author**: Rod Soto, Splunk - **ID**: a1c5a85e-a162-410c-a5d9-99ff639e5a52 diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md index b6d776b050..7b67a47f55 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for cloud provisioning activities from previously unseen citie - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-10-09 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: e7ecc5e0-88df-48b9-91af-51104c68f02f diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md index ae76ca25b9..a8b277a7f0 100644 --- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md +++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for cloud provisioning activities from previously unseen count - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2020-10-09 - **Author**: Rico Valdez, Bhavin Patel, Splunk - **ID**: 94994255-3acf-4213-9b3f-0494df03bb31 diff --git a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md index 44b32f51ab..fd324a7444 100644 --- a/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md +++ b/docs/_posts/2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides detection of accounts with high risk roles by projects. Com - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-09 - **Author**: Rod Soto, Splunk - **ID**: 27af8c15-38b0-4408-b339-920170724adb diff --git a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md index bd1aa88041..ab54f85b31 100644 --- a/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md +++ b/docs/_posts/2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides detection of high risk permissions by resource and accounts - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-09 - **Author**: Rod Soto, Splunk - **ID**: 2e70ef35-2187-431f-aedc-4503dc9b06ba diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md index 049fd46c6d..6479f37abb 100644 --- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md +++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for specific authentication events from the Windows Security E - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-15 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: f5939373-8054-40ad-8c64-cec478a22a4b @@ -57,8 +58,8 @@ This search looks for specific authentication events from the Windows Security E #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_activity_related_to_pass_the_hash_attacks_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md index 3a6395fb52..800f6c62c0 100644 --- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md +++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search looks for commands that the SNICat tool uses in the TLS SNI field. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-21 - **Author**: Shannon Davis, Splunk - **ID**: 82d06410-134c-11eb-adc1-0242ac120002 diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md index 8c054fb27d..f7ad277be7 100644 --- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md +++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md @@ -30,7 +30,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,7 +38,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: c3be767e-7959-44c5-8976-0e9c12a91ad2 @@ -71,8 +72,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_ipv6_network_infrastructure_threats_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md index 7f0955e896..ae5f12d539 100644 --- a/docs/_posts/2020-10-28-detect_port_security_violation.md +++ b/docs/_posts/2020-10-28-detect_port_security_violation.md @@ -30,7 +30,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,7 +38,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 2de3d5b8-a4fa-45c5-8540-6d071c194d24 @@ -69,8 +70,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_port_security_violation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md index 20d08d429d..38738b3f46 100644 --- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md +++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md @@ -25,7 +25,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: cc590c66-f65f-48f2-986a-4797244762f8 diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md index 33516a9de3..ed7fbe2c97 100644 --- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md +++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md @@ -28,7 +28,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-10-28 - **Author**: Mikael Bjerkeland, Splunk - **ID**: 42b3b753-5925-49c5-9742-36fa40a73990 @@ -66,8 +67,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_traffic_mirroring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md index 0a97a280b8..e2b5bcf991 100644 --- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md +++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md index 24f476557b..e0b308b035 100644 --- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md +++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: c114aaca-68ee-41c2-ad8c-32bf21db8769 diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md index 300d8a2433..3e84dae4d9 100644 --- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md +++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-11-06 - **Author**: Rod Soto, Jose Hernandez, Splunk - **ID**: 69c12d59-d951-431e-ab77-ec426b8d65e6 diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md index 7fc45467bd..0de6f8b3cd 100644 --- a/docs/_posts/2020-11-09-common_ransomware_extensions.md +++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The search looks for file modifications with extensions commonly used by Ransomw - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md index f2a462d996..afa8f96d8a 100644 --- a/docs/_posts/2020-11-09-common_ransomware_notes.md +++ b/docs/_posts/2020-11-09-common_ransomware_notes.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The search looks for files created with names matching those typically used in r - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd71 @@ -52,9 +53,9 @@ The search looks for files created with names matching those typically used in r #### Macros The SPL above uses the following Macros: +* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml) Note that `common_ransomware_notes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md index f3cdaf3e75..930b4405c1 100644 --- a/docs/_posts/2020-11-09-deleting_shadow_copies.md +++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: b89919ed-ee5f-492c-b139-95dbb162039e diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md index 9bc5498855..3a461a3d92 100644 --- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md +++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search identifies endpoints that have caused a relatively high number of ac - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) + - **Last Updated**: 2020-11-09 - **Author**: David Dorsey, Splunk - **ID**: c026e3dd-7e18-4abb-8f41-929e836efe74 diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md index e9fb6edae0..3f662f2a90 100644 --- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md +++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for fast execution of processes used for system network config - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-10 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-48cc-b1e4-16ae10145893 @@ -55,9 +56,9 @@ This search looks for fast execution of processes used for system network config #### Macros The SPL above uses the following Macros: +* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml) Note that `detect_processes_used_for_system_network_configuration_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md index 3c7a72d0be..12ca845e21 100644 --- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md +++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for executions of cmd.exe spawned by a process that is often a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-11-10 - **Author**: Bhavin Patel, Splunk - **ID**: dcfd6b40-42f9-469d-a433-2e53f7486664 @@ -57,8 +58,8 @@ This search looks for executions of cmd.exe spawned by a process that is often a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml) diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md index 4d45e66f26..1d29bcd717 100644 --- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md +++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ The search looks for modifications to registry keys that control the enforcement - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-11-18 - **Author**: David Dorsey, Patrick Bareiss, Splunk - **ID**: bbc644bc-37df-4e1a-9c88-ec9a53e2038c diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md index a8134fa886..12c2392339 100644 --- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md +++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for processes launched from files that have double extensions - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-18 - **Author**: Rico Valdez, Splunk - **ID**: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md index 4e5dcb4cb6..256a09e976 100644 --- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md +++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for processes launched from files with at least five spaces in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-11-19 - **Author**: Rico Valdez, Splunk - **ID**: ab0353e6-a956-420b-b724-a8b4846d5d5a diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md index aa09c399ae..405d4bb774 100644 --- a/docs/_posts/2020-11-23-processes_created_by_netsh.md +++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for processes launching netsh.exe to execute various commands - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2020-11-23 - **Author**: Bhavin Patel, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162041e diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md index 5a873211ea..d85334dab8 100644 --- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md +++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search detects the process execution and arguments required to silently cre - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-23 - **Author**: David Dorsey, Splunk - **ID**: 404620de-46d8-48b6-90cc-8a8d7b0876a3 diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md index 9c15de4439..7024a166ca 100644 --- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md +++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The search looks for reg.exe modifying registry keys that define Windows service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-11-26 - **Author**: Rico Valdez, Splunk - **ID**: 8470d755-0c13-45b3-bd63-387a373c10cf @@ -84,6 +85,7 @@ It is unusual for a service to be created or modified by directly manipulating t #### Associated Analytic story * [Windows Service Abuse](/stories/windows_service_abuse) * [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md index b16b92240f..6c60273063 100644 --- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md +++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This search looks for flags passed to schtasks.exe on the command-line that indi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-07 - **Author**: Bhavin Patel, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md index 7429c95078..42aaca586d 100644 --- a/docs/_posts/2020-12-08-shim_database_file_creation.md +++ b/docs/_posts/2020-12-08-shim_database_file_creation.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for shim database files being written to default directories. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md index ae59045b1f..c0a50a59f6 100644 --- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md +++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for process names that consist only of a single letter. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4 diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md index 1c1bef5a65..9cdbf4da70 100644 --- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md +++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ During triage, review the parallel processes - what process moved the native Win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: a34aae96-ccf8-4aef-952c-3ea21444444d @@ -60,8 +61,8 @@ During triage, review the parallel processes - what process moved the native Win #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml) Note that `system_processes_run_from_unexpected_locations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md index 5324024d08..043ed8eb39 100644 --- a/docs/_posts/2020-12-08-unusually_long_command_line.md +++ b/docs/_posts/2020-12-08-unusually_long_command_line.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ Command lines that are extremely long may be indicative of malicious activity on - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-08 - **Author**: David Dorsey, Splunk - **ID**: c77162d3-f93c-45cc-80c8-22f6a4264e7f diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md index 7ff2e99eca..c9dfd7f685 100644 --- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md +++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -35,7 +35,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-08 - **Author**: Rico Valdez, Michael Haag, Splunk - **ID**: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md index 5120e9253b..4bc37c2866 100644 --- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md +++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-14 - **Author**: Patrick Bareiss, Splunk - **ID**: 701a8740-e8db-40df-9190-5516d3819787 diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md index 2b5317bdd0..9c8551af53 100644 --- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md +++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the assignment of rights to accesss content from another mai - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-15 - **Author**: Patrick Bareiss, Splunk - **ID**: b25d2973-303e-47c8-bacd-52b61604c6a7 @@ -57,8 +58,8 @@ This search detects the assignment of rights to accesss content from another mai #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_suspicious_rights_delegation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md index 87734840a8..f5b6b4eba8 100644 --- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md +++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search will detect more than 5 login failures in Office365 Azure Active Dir - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-16 - **Author**: Bhavin Patel, Splunk - **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02222 diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md index 9499a86bf7..b27a6767e4 100644 --- a/docs/_posts/2020-12-16-o365_pst_export_alert.md +++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search detects when a user has performed an Ediscovery search or exported a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-16 - **Author**: Rod Soto, Splunk - **ID**: 5f694cc4-a678-4a60-9410-bffca1b647dc @@ -49,8 +50,8 @@ This search detects when a user has performed an Ediscovery search or exported a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_pst_export_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md index 9bc1b83bcd..846fed3f6d 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects when an admin configured a forwarding rule for multiple mail - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-16 - **Author**: Patrick Bareiss, Splunk - **ID**: 7f398cfb-918d-41f4-8db8-2e2474e02c28 @@ -58,8 +59,8 @@ This search detects when an admin configured a forwarding rule for multiple mail #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_suspicious_admin_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md index 9d400d7f5b..1072d2add4 100644 --- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md +++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects when multiple user configured a forwarding rule to the same - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2020-12-16 - **Author**: Patrick Bareiss, Splunk - **ID**: f8dfe015-dbb3-4569-ba75-b13787e06aa4 @@ -58,8 +59,8 @@ This search detects when multiple user configured a forwarding rule to the same #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_suspicious_user_email_forwarding_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md index c9332e5abe..34be73c04b 100644 --- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md +++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2020-12-21 - **Author**: Michael Haag, Splunk - **ID**: 809b31d2-5462-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md index 00a5031036..fa160d0d34 100644 --- a/docs/_posts/2021-01-06-supernova_webshell.md +++ b/docs/_posts/2021-01-06-supernova_webshell.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This search aims to detect the Supernova webshell used in the SUNBURST attack. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2021-01-06 - **Author**: John Stoner, Splunk - **ID**: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1 diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md index b188949b73..91768c6df4 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md +++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-11 - **Author**: Rod Soto, Patrick Bareiss Splunk - **ID**: c79c164f-4b21-4847-98f9-cf6a9f49179e diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md index 3c1dbe49aa..b380812b43 100644 --- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md +++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search provides detection of users with KMS keys performing encryption spec - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-11 - **Author**: Rod Soto, Patrick Bareiss Splunk - **ID**: 884a5f59-eec7-4f4a-948b-dbde18225fdc diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md index 6b79b42acc..fd761f577b 100644 --- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md +++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-11 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6bd75 diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md index 93fe891bb7..9c0b070eaf 100644 --- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md +++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-12 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: ada0f478-84a8-4641-a3f1-d82362d6fd75 diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md index 7b719bd7af..99c5f10524 100644 --- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md +++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 9bbc62e8-55d8-11eb-ae93-0242ac130002 @@ -51,9 +52,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso #### Macros The SPL above uses the following Macros: +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) Note that `suspicious_microsoft_workflow_compiler_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -80,6 +81,7 @@ Although unlikely, limited instances have been identified coming from native Mic #### Associated Analytic story * [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_path.md b/docs/_posts/2021-01-12-suspicious_msbuild_path.md index 137e1855fe..fa4f0bbd18 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_path.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_path.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following analytic identifies msbuild.exe executing from a non-standard path - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: f5198224-551c-11eb-ae93-0242ac130002 @@ -66,9 +67,9 @@ The following analytic identifies msbuild.exe executing from a non-standard path #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that `suspicious_msbuild_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -97,6 +98,7 @@ Some legitimate applications may use a moved copy of msbuild.exe, triggering a f * [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild) * [Cobalt Strike](/stories/cobalt_strike) * [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md index 81c4ed85eb..1a125273e4 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 4006adac-5937-11eb-ae93-0242ac130002 @@ -66,9 +67,9 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that `suspicious_msbuild_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -97,6 +98,7 @@ Although unlikely, some legitimate applications may use a moved copy of msbuild, * [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild) * [Cobalt Strike](/stories/cobalt_strike) * [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md index e9d878adbb..c58d094e4d 100644 --- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md +++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: a115fba6-5514-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that `suspicious_msbuild_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Associated Analytic story * [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md index d152bc5870..efeeecba3a 100644 --- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md +++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies child processes spawning from "mshta.exe". Th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-12 - **Author**: Michael Haag, Splunk - **ID**: 60023bb6-5500-11eb-ae93-0242ac130002 @@ -79,6 +80,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md index 8cd378877a..692ddda2e3 100644 --- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md +++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2021-01-14 - **Author**: Bhavin Patel, Splunk - **ID**: a1e761ac-1344-4dbd-88b2-3f34c912d359 @@ -51,9 +52,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p #### Macros The SPL above uses the following Macros: +* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml) Note that `detect_hosts_connecting_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md index 79828cfa68..e05fed0193 100644 --- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md +++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for PowerShell processes launched with arguments that have cha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-19 - **Author**: David Dorsey, Splunk - **ID**: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 @@ -58,9 +59,9 @@ This search looks for PowerShell processes launched with arguments that have cha #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `malicious_powershell_process_with_obfuscation_techniques_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md new file mode 100644 index 0000000000..c79890e600 --- /dev/null +++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md @@ -0,0 +1,99 @@ +--- +title: "Suspicious Powershell Command-Line Arguments" +excerpt: "PowerShell +" +categories: + - Deprecated +last_modified_at: 2021-01-19 +toc: true +toc_label: "" +tags: + - PowerShell + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2021-01-19 +- **Author**: David Dorsey, Splunk +- **ID**: 2cdb91d2-542c-497f-b252-be495e71f38c + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + +#### Search + +``` + +| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* +| `suspicious_powershell_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `suspicious_powershell_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Known False Positives +Legitimate process can have this combination of command-line options, but it's not common. + +#### Associated Analytic story +* [Malicious PowerShell](/stories/malicious_powershell) + + +#### Kill Chain Phase +* Command & Control +* Actions on Objectives + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | tbd | + + + + +#### Reference + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/suspicious_powershell_command-line_arguments.yml) \| *version*: **6** \ No newline at end of file diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md index db3f512ad1..fd4a73b817 100644 --- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md +++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies "rundll32.exe" execution with inline protocol - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-20 - **Author**: Michael Haag, Splunk - **ID**: 91c79f14-5b41-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ The following analytic identifies "rundll32.exe" execution with inline protocol #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `detect_rundll32_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -86,6 +87,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) * [NOBELIUM Group](/stories/nobelium_group) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md index 72edef8e3e..b604289530 100644 --- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md +++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-20 - **Author**: Michael Haag, Splunk - **ID**: 4d33a488-5b5f-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `suspicious_mshta_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md index fb0429d8c6..54f0b2be26 100644 --- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md +++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-22 - **Author**: Michael Haag, Splunk - **ID**: cd5aed7e-5cea-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md index 188bdf5b87..9aa33b9703 100644 --- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md +++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for the execution of `nltest.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-25 - **Author**: Michael Haag, Splunk - **ID**: c3e05466-5f22-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md index 55fb2c979f..bf8c785791 100644 --- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md +++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides specific SAML access from specific Service Provider, user a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: bbe23980-6019-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md index 4317af733e..599a2a3fc4 100644 --- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md +++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 2f0604c6-6030-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md index a090f00c07..3dc7597328 100644 --- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md +++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md @@ -15,7 +15,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,6 +24,7 @@ This search looks for arguments to certutil.exe indicating the manipulation or e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 337a46be-600f-11eb-ae93-0242ac130002 @@ -69,6 +70,7 @@ Unless there are specific use cases, manipulating or exporting certificates usin #### Associated Analytic story * [Windows Persistence Techniques](/stories/windows_persistence_techniques) * [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md index 77afd2f759..ade5bd0bb8 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md @@ -14,7 +14,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -22,7 +22,8 @@ This search looks for a spike in number of of AWS security Hub alerts for an EC2 - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md index 2cd8276dbb..c6d3c34e9a 100644 --- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md +++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md @@ -16,7 +16,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -24,7 +24,8 @@ This search looks for a spike in number of of AWS security Hub alerts for an AWS - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md index 35307288d4..79f4afbd1a 100644 --- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md +++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the creation of a new Federation setting by alerting about a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: b2c81cc6-6040-11eb-ae93-0242ac130002 @@ -54,8 +55,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_add_app_role_assignment_grant_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md index f1cf5c0d8c..bc467ee498 100644 --- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md +++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: 8158ccc4-6038-11eb-ae93-0242ac130002 @@ -52,8 +53,8 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_excessive_sso_logon_errors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md index c854fcdcda..8ca563fe8c 100644 --- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md +++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the addition of a new Federated domain. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-26 - **Author**: Rod Soto, Splunk - **ID**: e155876a-6048-11eb-ae93-0242ac130002 @@ -54,8 +55,8 @@ This search detects the addition of a new Federated domain. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_new_federated_domain_added_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md index bf023b9640..162d5f574f 100644 --- a/docs/_posts/2021-01-26-revil_registry_entry.md +++ b/docs/_posts/2021-01-26-revil_registry_entry.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies suspicious modification in registry entry to keep some - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: e3d3f57a-c381-11eb-9e35-acde48001122 diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md index 8376299890..678ed078d5 100644 --- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md +++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-27 - **Author**: Shannon Davis, Splunk - **ID**: 93fbec4e-0375-440c-8db3-4508eca470c4 diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md index b6785cebd4..cdb221c44b 100644 --- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md +++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-28 - **Author**: Shannon Davis, Splunk - **ID**: 1de31d5d-8fa6-4ee0-af89-17069134118a diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md index 046262ea61..d3570a2c82 100644 --- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md +++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ Upon investigating, look for network connections to remote destinations (interna - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Splunk - **ID**: 070e9b80-6252-11eb-ae93-0242ac130002 @@ -87,6 +88,7 @@ Limited false positives related to third party software registering .DLL's. #### Associated Analytic story * [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) * [Cobalt Strike](/stories/cobalt_strike) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md index cd2ff2689e..23c55b3ae5 100644 --- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md +++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Patrick Bareiss, Splunk - **ID**: da63bc76-61ae-11eb-ae93-0242ac130002 @@ -83,6 +84,7 @@ Highly possible Server Administrators will troubleshoot with ntdsutil.exe, gener #### Associated Analytic story * [Credential Dumping](/stories/credential_dumping) * [HAFNIUM Group](/stories/hafnium_group) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md index 11354adb0c..c6860f31ae 100644 --- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md +++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-01-28 - **Author**: Michael Haag, Splunk - **ID**: 62732736-6250-11eb-ae93-0242ac130002 @@ -86,6 +87,7 @@ Limited false positives with the query restricted to specified paths. Add more w #### Associated Analytic story * [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) * [Iceid](/stories/iceid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md index e142d9f97b..5cb883a4cf 100644 --- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md +++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the heap-based buffer overflow of sudoedit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-01-29 - **Author**: Shannon Davis, Splunk - **ID**: 10f2bae0-bbe6-4984-808c-37dc1c67980d diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md index ff8220b2e3..db5c7ce67e 100644 --- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md +++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,7 +26,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-02-01 - **Author**: Michael Haag, Splunk - **ID**: 21276daa-663d-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md index 438dfd9f60..9598127723 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 @@ -56,9 +57,9 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `detect_rundll32_application_control_bypass_-_advpack_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may use advpack.dll or ieadvpack #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md index 248a93fbd5..3368221a41 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 61e7b44a-6088-4f26-b788-9a96ba13b37a @@ -56,9 +57,9 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `detect_rundll32_application_control_bypass_-_setupapi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may use setupapi triggering a fa #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md index 57fa4d3545..c7b8c0dee1 100644 --- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md +++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 @@ -56,9 +57,9 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `detect_rundll32_application_control_bypass_-_syssetup_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may use syssetup.dll, triggering #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md index 82ebf20a90..14f902c897 100644 --- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md +++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe executing a DLL function name, St - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-04 - **Author**: Michael Haag, Splunk - **ID**: 9319dda5-73f2-4d43-a85a-67ce961bddb7 @@ -56,9 +57,9 @@ The following analytic identifies rundll32.exe executing a DLL function name, St #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `suspicious_rundll32_startw_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md index 1785e79663..cbe3a11548 100644 --- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md +++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-09 - **Author**: Michael Haag, Splunk - **ID**: 8c00a385-9b86-4ac0-8932-c9ec3713b159 @@ -56,9 +57,9 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `suspicious_rundll32_dllregisterserver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ This is likely to produce false positives and will require some filtering. Tune #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md index 882959010d..a73dbe1d88 100644 --- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md +++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-11 - **Author**: Michael Haag, Splunk - **ID**: 723716de-ee55-4cd4-9759-c44e7e55ba4b @@ -84,6 +85,7 @@ Although unlikely, some legitimate applications (ex. web browsers) may spawn a c #### Associated Analytic story * [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md index c28205cdfb..8cfbd98344 100644 --- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies regasm.exe spawning a process. This particular - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-12 - **Author**: Michael Haag, Splunk - **ID**: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f @@ -80,6 +81,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa #### Associated Analytic story * [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md index 58a1440fbd..0493e2c8a9 100644 --- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md +++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies regsvcs.exe spawning a process. This particula - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-02-12 - **Author**: Michael Haag, Splunk - **ID**: bc477b57-5c21-4ab6-9c33-668772e7f114 @@ -81,6 +82,7 @@ Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a fa #### Associated Analytic story * [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md index acc6840249..7c62d7469d 100644 --- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md +++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md @@ -26,7 +26,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,7 +34,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-02-22 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4 diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md index 4768ae8015..e8985ca025 100644 --- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md +++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 5876d429-0240-4709-8b93-ea8330b411b5 diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md index ed01cf30cf..cd0e397e73 100644 --- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md +++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ The following analytic identifies the use of a curl contacting suspicious remote - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 3f613dc0-21f2-4063-93b1-5d3c15eef22f diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md index ecfd5764db..ba3fa96d95 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md @@ -25,7 +25,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -41,6 +41,7 @@ Upon triage, capture the property list file being written to disk and review for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: c3194009-e0eb-4f84-87a9-4070f8688f00 diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md index 66e8268f0a..20e9befde4 100644 --- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md +++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md @@ -24,7 +24,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -39,7 +39,8 @@ Upon triage, capture the property list file being written to disk and review for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: 20ba6c32-c733-4a32-b64e-2688cf231399 diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md index 31d7f4297e..a316984b17 100644 --- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md +++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md @@ -20,7 +20,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-02-22 - **Author**: Michael Haag, Splunk - **ID**: e1997b2e-655f-4561-82fd-aeba8e1c1a86 diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md index 40522001aa..4fde88e182 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following analytic identifies the use of PowerShell downloading a file using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 1a93b7ea-7af7-11eb-adb5-acde48001122 @@ -57,9 +58,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `any_powershell_downloadfile_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md index 8cebcb80b6..b35be34ba8 100644 --- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md +++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the use of PowerShell downloading a file using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 4d015ef2-7adf-11eb-95da-acde48001122 @@ -56,9 +57,9 @@ The following analytic identifies the use of PowerShell downloading a file using #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `any_powershell_downloadstring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md index 7dbac3ebb2..fb58a0306c 100644 --- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md +++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md @@ -26,7 +26,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -39,6 +39,7 @@ Upon triage, fodhelper.exe will have a child process and read access will occur - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 909f8fd8-7ac8-11eb-a1f3-acde48001122 diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md index 62778382d4..2c47a8618a 100644 --- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md +++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 538d0152-7aaa-11eb-beaa-acde48001122 diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md index 83e8329825..f29aa141cc 100644 --- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md +++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following detection identifies Scheduled Tasks registering (creating a new t - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-01 - **Author**: Michael Haag, Splunk - **ID**: 7feb7972-7ac3-11eb-bac8-acde48001122 @@ -87,6 +88,7 @@ Limited false positives may be present. Filter as needed by parent process or co * [Ransomware](/stories/ransomware) * [Ryuk Ransomware](/stories/ryuk_ransomware) * [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md index 43cb9afe61..868ce25108 100644 --- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md +++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md @@ -26,7 +26,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,7 +34,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-03-02 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0dac4 diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md index 15452f8d5f..990621fbe9 100644 --- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md +++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-02 - **Author**: Michael Haag, Splunk - **ID**: f1126df0-7bd5-11eb-988f-acde48001122 diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md index 604cb89ea3..c0f1a25a4e 100644 --- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md +++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-02 - **Author**: Rod Soto, Jose Hernandez, Michael Haag, Splunk - **ID**: 23150a40-9301-4195-b802-5bb4f43067fb diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md index 2d024fa924..740759c315 100644 --- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md +++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-03 - **Author**: Michael Haag, Splunk - **ID**: 1a382c6c-7c2e-11eb-ac69-acde48001122 @@ -56,9 +57,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `nishang_powershelltcponeline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md index 5b4d03715a..0bb56d9659 100644 --- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md +++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-03 - **Author**: Michael Haag, Splunk - **ID**: 0f03423c-7c6a-11eb-bc47-acde48001122 @@ -59,10 +60,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `w3wp_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md index 0f58fb049b..9c3ee9d414 100644 --- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md +++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytics identifies a big number of instance of ransomware notes - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-03-12 - **Author**: Teoderick Contreras - **ID**: eff7919a-8330-11eb-83f8-acde48001122 diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md index a2a5001331..51e6f95da6 100644 --- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md +++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytics identifies the resizing of shadowstorage by ransomware m - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-12 - **Author**: Teoderick Contreras - **ID**: bc760ca6-8336-11eb-bcbb-acde48001122 diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md index 8593a94876..1d460d0ba7 100644 --- a/docs/_posts/2021-03-16-high_process_termination_frequency.md +++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytics are designed to indentify a high frequency of process termination - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-03-16 - **Author**: Teoderick Contreras - **ID**: 17cd75b2-8666-11eb-9ab4-acde48001122 diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md index 06c1c1124c..585aeea63b 100644 --- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md +++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for high frequency of file deletion relative to process name a - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-03-16 - **Author**: Teoderick Contreras - **ID**: 45b125c4-866f-11eb-a95a-acde48001122 diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md index 6edab193be..a3d5ce5217 100644 --- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md +++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytics are designed to identifies some CLOP ransomware variant - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 5a8a2a72-8322-11eb-9ee9-acde48001122 diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md index b429eddf49..d82cc90cb6 100644 --- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md +++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This detection is to identify the common service name created by the CLOP ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-03-17 - **Author**: Teoderick Contreras - **ID**: 07e08a12-870c-11eb-b5f9-acde48001122 diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md index fb90a1fbce..7b282dcae4 100644 --- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md +++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-23 - **Author**: Michael Haag, Splunk - **ID**: bfe94226-8c10-11eb-a4b3-acde48001122 @@ -80,6 +81,7 @@ Typically seen used to `encode` files, but it is possible to see legitimate use #### Associated Analytic story * [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md index 95112061af..bc967a9e8e 100644 --- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md +++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-29 - **Author**: Michael Haag, Splunk - **ID**: 39e2605a-90d8-11eb-899e-acde48001122 @@ -52,9 +53,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `powershell_start-bitstransfer_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md index 944665c3fa..6857fc608d 100644 --- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md +++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The following query uses IAM events to track the success of a group being delete - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-03-31 - **Author**: Michael Haag, Splunk - **ID**: e776d06c-9267-11eb-819b-acde48001122 diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md index 794e51e70a..632a4f9e48 100644 --- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md +++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identifies suspicious firewall disabling using netsh applicati - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-31 - **Author**: Teoderick Contreras, Splunk - **ID**: 6860a62c-9203-11eb-9e05-acde48001122 diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md index 51db9691bc..53c1a92939 100644 --- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md +++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ In addition to trust discovery, review parallel processes for additional behavio - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-03-31 - **Author**: Michael Haag, Splunk - **ID**: cc316032-924a-11eb-91a2-acde48001122 diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md index 0c8e429b08..854b6cc753 100644 --- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md +++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following detection identifies any malformed policy document exceptions with - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: f19e09b0-9308-11eb-b7ec-acde48001122 diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md index 59968de87c..9c820182c8 100644 --- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md +++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following detection identifes when a policy is deleted on AWS. This does not - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: ec3a9362-92fe-11eb-99d0-acde48001122 diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md index 978ea15849..22f95f2252 100644 --- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md +++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This detection identifies failure attempts to delete groups. We want to identify - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-01 - **Author**: Michael Haag, Splunk - **ID**: 723b861a-92eb-11eb-93b8-acde48001122 diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md index 098c549343..0cd8cb6116 100644 --- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md +++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-07 - **Author**: Ryan Becwar - **ID**: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md index d111fa989c..2d5be3420c 100644 --- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md +++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-08 - **Author**: Mauricio Velazco, Splunk - **ID**: 3a91a212-98a9-11eb-b86a-acde48001122 diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md index f796ed7e46..ff24741a49 100644 --- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md +++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-08 - **Author**: Michael Haag, Splunk - **ID**: 5d9c6eee-988c-11eb-8253-acde48001122 @@ -64,8 +65,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `winevent_scheduled_task_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md index 33d4461eb8..3d6313ce1a 100644 --- a/docs/_posts/2021-04-12-excel_spawning_powershell.md +++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 42d40a22-9be3-11eb-8f08-acde48001122 @@ -56,9 +57,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `excel_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md index a9c0564213..e4c73d9f42 100644 --- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies Microsoft Excel spawning Windows Script Host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 57fe880a-9be3-11eb-9bf3-acde48001122 diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md index 3c86bd5313..efd24b1e8e 100644 --- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md +++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,7 +36,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 203ef0ea-9bd8-11eb-8201-acde48001122 @@ -64,8 +65,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `winevent_scheduled_task_created_to_spawn_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md index dc724edfaa..c99fe3a69a 100644 --- a/docs/_posts/2021-04-12-winword_spawning_powershell.md +++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: b2c950b8-9be2-11eb-8658-acde48001122 @@ -56,9 +57,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `winword_spawning_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md index fd81f3e867..ac857ccb47 100644 --- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md +++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-12 - **Author**: Michael Haag, Splunk - **ID**: 637e1b5c-9be1-11eb-9c32-acde48001122 diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md index 8721c816f7..da247bc3e4 100644 --- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md +++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-13 - **Author**: Patrick Bareiss, Splunk - **ID**: 1fdd164a-def8-4762-83a9-9ffe24e74d5a diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md index 164a299c38..71ad03136e 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 7ed272a4-9c77-11eb-af22-acde48001122 diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md index 3e547a43c6..a86733a4da 100644 --- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md +++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 9015385a-9c84-11eb-bef2-acde48001122 diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md index 589b871d21..06c9952116 100644 --- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md +++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 80f9d53e-9ca1-11eb-b0d6-acde48001122 diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md index bf51c95cc2..785adc1070 100644 --- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md +++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this detection was designed to identifies suspicious spawned process of known MS - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 958751e4-9c5f-11eb-b103-acde48001122 @@ -56,9 +57,9 @@ this detection was designed to identifies suspicious spawned process of known MS #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `office_application_spawn_rundll32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md new file mode 100644 index 0000000000..9de72f5c47 --- /dev/null +++ b/docs/_posts/2021-04-13-windows_users_authenticate_using_explicit_credentials.md @@ -0,0 +1,120 @@ +--- +title: "Windows Users Authenticate Using Explicit Credentials" +excerpt: "Password Spraying +, Brute Force +" +categories: + - Endpoint +last_modified_at: 2021-04-13 +toc: true +toc_label: "" +tags: + - Password Spraying + - Brute Force + - Credential Access + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + + +- **Last Updated**: 2021-04-13 +- **Author**: Mauricio Velazco, Splunk +- **ID**: e61918fa-9ca4-11eb-836c-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + +#### Search + +``` + `wineventlog_security` EventCode=4648 +| bucket span=2m _time +| eval Source_Account = mvindex(Account_Name, 0) +| eval Destination_Account = mvindex(Account_Name, 1) +| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" +| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `windows_users_authenticate_using_explicit_credentials_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that `windows_users_authenticate_using_explicit_credentials_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventCode +* Security_ID +* Account_Name +* ComputerName + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. + +#### Known False Positives +A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. + +#### Associated Analytic story +* [Active Directory Password Spraying](/stories/active_directory_password_spraying) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Potential password spraying attack from $ComputerName$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) +* [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648) +* [https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md index 2d8c36ce47..a32de9c91b 100644 --- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md +++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search detects a potential malicious office document that create schedule t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-14 - **Author**: Teoderick Contreras, Splunk - **ID**: cc8b7b74-9d0f-11eb-8342-acde48001122 diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md index 841682a5d1..3075c5889f 100644 --- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md +++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this detection was designed to identifies suspicious office documents that using - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-14 - **Author**: Teoderick Contreras, Splunk - **ID**: b12c89bc-9d06-11eb-a592-acde48001122 diff --git a/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md new file mode 100644 index 0000000000..2782c9fcfd --- /dev/null +++ b/docs/_posts/2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md @@ -0,0 +1,116 @@ +--- +title: "Windows Disabled Users Failing To Authenticate Kerberos" +excerpt: "Password Spraying +, Brute Force +" +categories: + - Endpoint +last_modified_at: 2021-04-14 +toc: true +toc_label: "" +tags: + - Password Spraying + - Brute Force + - Credential Access + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + + +- **Last Updated**: 2021-04-14 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 98f22d82-9d62-11eb-9fcf-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + +#### Search + +``` +`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `windows_disabled_users_failing_to_authenticate_kerberos_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that `windows_disabled_users_failing_to_authenticate_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventCode +* Result_Code +* Account_Name +* Client_Address + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Known False Positives +A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. + +#### Associated Analytic story +* [Active Directory Password Spraying](/stories/active_directory_password_spraying) +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md new file mode 100644 index 0000000000..4518283d10 --- /dev/null +++ b/docs/_posts/2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md @@ -0,0 +1,116 @@ +--- +title: "Windows Invalid Users Failed Authentication via Kerberos" +excerpt: "Password Spraying +, Brute Force +" +categories: + - Endpoint +last_modified_at: 2021-04-14 +toc: true +toc_label: "" +tags: + - Password Spraying + - Brute Force + - Credential Access + - Credential Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + + +- **Last Updated**: 2021-04-14 +- **Author**: Mauricio Velazco, Splunk +- **ID**: 001266a6-9d5b-11eb-829b-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1110.003](https://attack.mitre.org/techniques/T1110/003/) | Password Spraying | Credential Access | + +| [T1110](https://attack.mitre.org/techniques/T1110/) | Brute Force | Credential Access | + +#### Search + +``` +`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" +| bucket span=2m _time +| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address +| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address +| eval upperBound=(comp_avg+comp_std*3) +| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) +| search isOutlier=1 +| `windows_invalid_users_failed_authentication_via_kerberos_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) + +Note that `windows_invalid_users_failed_authentication_via_kerberos_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventCode +* Result_Code +* Account_Name +* Client_Address + + +#### How To Implement +To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. + +#### Known False Positives +A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. + +#### Associated Analytic story +* [Active Directory Password Spraying](/stories/active_directory_password_spraying) +* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Potential Kerberos based password spraying attack from $Client_Address$ | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1110/003/](https://attack.mitre.org/techniques/T1110/003/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md index 1c8d69c92d..5d176a10b9 100644 --- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md +++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ this search is to detect potential DNS exfiltration using nslookup application. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-15 - **Author**: Teoderick Contreras, Splunk - **ID**: 2452e632-9e0d-11eb-bacd-acde48001122 diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md index 6c0f66cea4..bc2054edbd 100644 --- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md +++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The analytics returned fields allow analysts to investigate the event further by - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-04-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 57ad5a64-9df7-11eb-a290-acde48001122 diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md index 75449dc77f..23e89d1c70 100644 --- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md +++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ this search is designed to detect suspicious powershell process that tries to in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ec102cb2-a0f5-11eb-9b38-acde48001122 diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md index 6a4f2178e9..4229bf6c20 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md +++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 523c2684-a101-11eb-916b-acde48001122 @@ -54,8 +55,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `schedule_task_with_http_command_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -78,6 +79,7 @@ unknown #### Associated Analytic story * [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md index 9eb118e35d..e8e06cc11b 100644 --- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md +++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 75b00fd8-a0ff-11eb-8b31-acde48001122 @@ -54,8 +55,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `schedule_task_with_rundll32_command_trigger_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -80,6 +81,7 @@ unknown * [Windows Persistence Techniques](/stories/windows_persistence_techniques) * [Trickbot](/stories/trickbot) * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md index 9b74ed04d6..f51daca822 100644 --- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md +++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is designed to detect suspicious wermgr.exe process that tries to co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ed313326-a0f9-11eb-a89c-acde48001122 diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md index 618b042d4a..316399c8bc 100644 --- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md +++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ this search is designed to detect potential malicious wermgr.exe process that dr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: ab3bcce0-a105-11eb-973c-acde48001122 diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md index efbd02d028..cd6484e883 100644 --- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md +++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is designed to detect suspicious cmd and powershell process spawned - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-19 - **Author**: Teoderick Contreras, Splunk - **ID**: e8fc95bc-a107-11eb-a978-acde48001122 @@ -51,10 +52,10 @@ This search is designed to detect suspicious cmd and powershell process spawned #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `wermgr_process_spawned_cmd_or_powershell_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md index 944cf90e84..d64f895540 100644 --- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md +++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect potential DNS exfiltration using nslookup application. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-21 - **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk - **ID**: 0a69fdaa-a2b8-11eb-b16d-acde48001122 diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md index 54f2dd6ee4..73aecab177 100644 --- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md +++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is designed to detect high frequency of archive files data exfiltrat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2021-04-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 4477f3ea-a28f-11eb-b762-acde48001122 diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md index bf5cbcc99e..7985fab248 100644 --- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md +++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Teoderick Contreras, Splunk - **ID**: 9364ee8e-a39a-11eb-8f1d-acde48001122 diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md index 41206d1664..7df19cfc40 100644 --- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md +++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies the latest behavior utilized by IcedID malwar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Splunk - **ID**: c661f6be-a38c-11eb-be57-acde48001122 @@ -56,9 +57,9 @@ The following detection identifies the latest behavior utilized by IcedID malwar #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `office_product_spawning_rundll32_with_no_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md index 5362ec99a5..9129a2ed60 100644 --- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md +++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2021-04-22 - **Author**: Teoderick Contreras, Splunk - **ID**: e2b36208-a364-11eb-8909-acde48001122 diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md index 30b9ce5984..f64391b9fd 100644 --- a/docs/_posts/2021-04-22-winword_spawning_cmd.md +++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-22 - **Author**: Michael Haag, Splunk - **ID**: 6fcbaedc-a37b-11eb-956b-acde48001122 @@ -56,8 +57,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `winword_spawning_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md index 4056b46e6f..0951daa0be 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md +++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: e8c591f4-a6d7-11eb-8cf7-acde48001122 diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md index baefd0872a..d58b9d4149 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md +++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: 6925fe72-a6d5-11eb-9e17-acde48001122 diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md index de0815184d..ca62d39cd8 100644 --- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md +++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies the latest behavior utilized by different mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-26 - **Author**: Michael Haag, Splunk - **ID**: 6078fa20-a6d2-11eb-b662-acde48001122 @@ -56,9 +57,9 @@ The following detection identifies the latest behavior utilized by different mal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `office_product_spawning_mshta_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md index b38b0a24f4..36bdbfb2c2 100644 --- a/docs/_posts/2021-04-26-trickbot_named_pipe.md +++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ this search is to detect potential trickbot infection through the create/connect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 1804b0a4-a682-11eb-8f68-acde48001122 diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md index f010b34788..944d1a7bce 100644 --- a/docs/_posts/2021-04-29-icacls_deny_command.md +++ b/docs/_posts/2021-04-29-icacls_deny_command.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies a potential adversary that changes the security permiss - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: cf8d753e-a8fe-11eb-8f58-acde48001122 diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md index d42b3ec5ab..b01176f5b5 100644 --- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md +++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic will detect suspicious driver loaded paths. This technique is comm - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: f880acd4-a8f1-11eb-a53b-acde48001122 diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md index 36142431a9..256ab3fced 100644 --- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md +++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic identifies XMRIG coinminer driver installation on the system. The - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-04-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 90080fa6-a8df-11eb-91e4-acde48001122 diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md index ff1b4c03c7..d660a41b2b 100644 --- a/docs/_posts/2021-05-04-deleting_of_net_users.md +++ b/docs/_posts/2021-05-04-deleting_of_net_users.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 1c8c6f66-acce-11eb-aafb-acde48001122 @@ -51,8 +52,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `deleting_of_net_users_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md index 19b1233b40..fde3186372 100644 --- a/docs/_posts/2021-05-04-disabling_net_user_account.md +++ b/docs/_posts/2021-05-04-disabling_net_user_account.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will identify a suspicious command-line that disables a user accou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: c0325326-acd6-11eb-98c2-acde48001122 @@ -51,8 +52,8 @@ This analytic will identify a suspicious command-line that disables a user accou #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `disabling_net_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md index 0787e3de31..1bba356f13 100644 --- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md +++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will identify suspicious series of command-line to disable several - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 8fa2a0f0-acd9-11eb-8994-acde48001122 diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md index b82b119fae..3d6d98bdb7 100644 --- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md +++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies suspicious series of attempt to kill multiple services - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: ae8d3f4a-acd7-11eb-8846-acde48001122 @@ -52,8 +53,8 @@ This analytic identifies suspicious series of attempt to kill multiple services #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `excessive_service_stop_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md index 0d23a51ed9..2206321efd 100644 --- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md +++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: fe5bca48-accb-11eb-a67c-acde48001122 diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md index ac47559f62..f29015212f 100644 --- a/docs/_posts/2021-05-04-icacls_grant_command.md +++ b/docs/_posts/2021-05-04-icacls_grant_command.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies potential adversaries that modify the security permissi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: b1b1e316-accc-11eb-a9b4-acde48001122 diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md index c196bb8dea..2f16ecbb28 100644 --- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md +++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies suspicious modification of ACL permission to a files or - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 7e8458cc-acca-11eb-9e3f-acde48001122 diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md index 1619f58636..231e171b3b 100644 --- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md +++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ffaa42c-acdb-11eb-9ad3-acde48001122 diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md index 05b58eb45d..045aa20d17 100644 --- a/docs/_posts/2021-05-05-suspicious_process_file_path.md +++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic will detect a suspicious process running in a file path w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-05 - **Author**: Teoderick Contreras, Splunk - **ID**: 9be25988-ad82-11eb-a14f-acde48001122 diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md index f7f3322f05..6807d4fa96 100644 --- a/docs/_posts/2021-05-06-download_files_using_telegram.md +++ b/docs/_posts/2021-05-06-download_files_using_telegram.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic will identify a suspicious download by the Telegram appli - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 58194e28-ae5e-11eb-8912-acde48001122 diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md index 8daf2ec96d..c29c19b8d9 100644 --- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md +++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will detect a suspicious Telegram process enumerating all network - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: fcd74532-ae54-11eb-a5ab-acde48001122 @@ -50,8 +51,8 @@ This analytic will detect a suspicious Telegram process enumerating all network #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `enumerate_users_local_group_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md index 3da677b749..fb1bb577a2 100644 --- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md +++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 45e52536-ae42-11eb-b5c6-acde48001122 @@ -52,8 +53,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `excessive_usage_of_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md index fe0f2a8567..97c12c8414 100644 --- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md +++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will identify suspicious executable or scripts (known file extensi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-06 - **Author**: Teoderick Contreras, Splunk - **ID**: a7e3f0f0-ae42-11eb-b245-acde48001122 diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md index 7eac03a9eb..41ee4e0891 100644 --- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md +++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-07 - **Author**: Teoderick Contreras, Splunk - **ID**: 0bdf6092-af17-11eb-939a-acde48001122 diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md index cff46416f3..d3a6b7ceef 100644 --- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md +++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This analytic identifies an on demand run of a Windows Schedule Task through she - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-07 - **Author**: Teoderick Contreras, Splunk - **ID**: bb37061e-af1f-11eb-a159-acde48001122 diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md index b3872b262d..4cb9bd57d4 100644 --- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md +++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This following analytic detects PowerShell command to delete shadow copy using t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 @@ -50,8 +51,8 @@ This following analytic detects PowerShell command to delete shadow copy using t #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `delete_shadowcopy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md index 0aa715deb8..a8e33958d5 100644 --- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md +++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-13 - **Author**: Teoderick Contreras, Splunk - **ID**: f87b5062-b405-11eb-a889-acde48001122 diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md index 333f2d1fe4..9faf6ec155 100644 --- a/docs/_posts/2021-05-13-slui_runas_elevated.md +++ b/docs/_posts/2021-05-13-slui_runas_elevated.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-13 - **Author**: Michael Haag, Splunk - **ID**: 8d124810-b3e4-11eb-96c7-acde48001122 diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md index 0cd4be8024..701f9cd90c 100644 --- a/docs/_posts/2021-05-13-slui_spawning_a_process.md +++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-13 - **Author**: Michael Haag, Splunk - **ID**: 879c4330-b3e0-11eb-b1b1-acde48001122 diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md index 30cdeafa19..dc92cf5968 100644 --- a/docs/_posts/2021-05-18-services_escalate_exe.md +++ b/docs/_posts/2021-05-18-services_escalate_exe.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-18 - **Author**: Michael Haag, Splunk - **ID**: c448488c-b7ec-11eb-8253-acde48001122 diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md index 12716262b9..e799d73728 100644 --- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md +++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies suspicious PowerShell command to allow inbound - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-19 - **Author**: Teoderick Contreras, Splunk - **ID**: a5d85486-b89c-11eb-8267-acde48001122 @@ -55,8 +56,8 @@ The following analytic identifies suspicious PowerShell command to allow inbound #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `allow_inbound_traffic_in_firewall_rule_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md index f7675bce68..a522977e55 100644 --- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md +++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-19 - **Author**: Teoderick Contreras, Splunk - **ID**: a36972c8-b894-11eb-9f78-acde48001122 @@ -55,8 +56,8 @@ This search is to detect known mailsniper.ps1 functions executed in a machine. T #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `mailsniper_invoke_functions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md index 0ae370c2b9..3da8742468 100644 --- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md +++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md @@ -29,7 +29,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-20 - **Author**: Michael Haag, Splunk - **ID**: eb277ba0-b96b-11eb-b00e-acde48001122 @@ -68,8 +69,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `cmd_echo_pipe_-_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md index 8986ba7d80..134fa9d82d 100644 --- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md +++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md @@ -21,7 +21,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-21 - **Author**: Drew Church, Michael Haag, Splunk - **ID**: a081836a-ba4d-11eb-8593-acde48001122 diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md index a8f4204573..902c784577 100644 --- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md +++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 5672819c-be09-11eb-bbfb-acde48001122 diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md index 2a67507e1f..bae3dbe879 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md +++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md @@ -36,7 +36,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -45,6 +45,7 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-05-27 - **Author**: Michael Haag, Splunk - **ID**: 42b4b438-beed-11eb-ba1d-acde48001122 diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md index 5089235d36..b858b58629 100644 --- a/docs/_posts/2021-05-27-detect_sharphound_usage.md +++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md @@ -36,7 +36,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -45,6 +45,7 @@ The following analytic identifies SharpHound binary usage by using the original - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-05-27 - **Author**: Michael Haag, Splunk - **ID**: dd04b29a-beed-11eb-87bc-acde48001122 diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md index 4b7d5a4f24..9c853627a5 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md @@ -36,7 +36,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -45,6 +45,7 @@ The following analytic identifies the common command-line argument used by Azure - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: 26f02e96-c300-11eb-b611-acde48001122 diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md index fd99ce7d96..7d57da21cb 100644 --- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md +++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md @@ -36,7 +36,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -45,6 +45,7 @@ The following analytic is similar to SharpHound file modifications, but this ins - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: 1c34549e-c31b-11eb-996b-acde48001122 diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md index 4ba79877dc..cc0653c8df 100644 --- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md +++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md @@ -36,7 +36,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -45,6 +45,7 @@ The following analytic identifies common command-line arguments used by SharpHou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-01 - **Author**: Michael Haag, Splunk - **ID**: a0bdd2f6-c2ff-11eb-b918-acde48001122 diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md index 7c02634c40..b1a90400fd 100644 --- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search detects the suspicious commandline argument of revil ransomware to e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 624919bc-c382-11eb-adcc-acde48001122 diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md index d73a9e8c23..1365541197 100644 --- a/docs/_posts/2021-06-02-modification_of_wallpaper.md +++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies suspicious modification of registry to deface or change - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: accb0712-c381-11eb-8e5b-acde48001122 diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md index a62b24aa5e..2f6e23d65a 100644 --- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md +++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies suspicious commandline parameter that are commonly used - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 85facebe-c382-11eb-9c3e-acde48001122 diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md index 2266a5b487..a4e7741d26 100644 --- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md +++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is designed to detect potential malicious process loading COM object - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-02 - **Author**: Teoderick Contreras, Splunk - **ID**: 9d911ce0-c3be-11eb-b177-acde48001122 diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md index 91328a603b..4c2c14ec8b 100644 --- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md +++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search detects a suspicioous termination of known services killed by ransom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 3070f8e0-c528-11eb-b2a0-acde48001122 diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md index 56d5b72cd7..11bb005ab0 100644 --- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md +++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This detection targets behaviors observed in post exploit kits like Meterpreter - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) - **Last Updated**: 2021-06-07 - **Author**: Michael Hart - **ID**: f443dac2-c7cf-11eb-ab51-acde48001122 diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md index c22bc174bd..53516d3baf 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md +++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -35,7 +35,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-08 - **Author**: Michael Haag, Splunk - **ID**: a26d9db4-c883-11eb-9d75-acde48001122 @@ -63,8 +64,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_fileless_process_injection_via_getprocaddress_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md index d86befa6ba..43cb31aa43 100644 --- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md +++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,7 +34,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-08 - **Author**: Michael Haag, Splunk - **ID**: 8acbc04c-c882-11eb-b060-acde48001122 @@ -62,8 +63,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_fileless_script_contains_base64_encoded_content_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md index 8fcb92d4d4..c850f8cdd2 100644 --- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: bc1dc6b8-c954-11eb-bade-acde48001122 @@ -56,8 +57,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_empire_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md index 6aea137485..00abdb1da2 100644 --- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md +++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: 8148c29c-c952-11eb-9255-acde48001122 @@ -51,8 +52,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_mimikatz_with_powershell_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md index 4f36a9efde..d02d68c5cd 100644 --- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md +++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-09 - **Author**: Michael Haag, Splunk - **ID**: a21e3484-c94d-11eb-b55b-acde48001122 @@ -51,8 +52,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `unloading_amsi_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md index 813d623191..b79070ac73 100644 --- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md +++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: cd80a6ac-c9d9-11eb-8839-acde48001122 diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md index a25a37df58..c8f60558e0 100644 --- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md +++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 236e7c8e-c9d9-11eb-a824-acde48001122 diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md index 23c0cfdc37..43f1065166 100644 --- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md +++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a modification of file or directory permission using ta - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: fa7ca5c6-c9d8-11eb-bce9-acde48001122 diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md index 89dec59bdc..0a65be2b91 100644 --- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md +++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 637557ec-ca08-11eb-bd0a-acde48001122 @@ -54,8 +55,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_creating_thread_mutex_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md index 385d47d50a..e8c69e3fba 100644 --- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md +++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Michael Haag, Splunk - **ID**: e1866ce2-ca22-11eb-8e44-acde48001122 @@ -56,8 +57,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_domain_enumeration_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md new file mode 100644 index 0000000000..1a662b3dc7 --- /dev/null +++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md @@ -0,0 +1,117 @@ +--- +title: "PowerShell Loading DotNET into Memory via Reflection" +excerpt: "Command and Scripting Interpreter +, PowerShell +" +categories: + - Endpoint +last_modified_at: 2021-06-10 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - PowerShell + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud + + +- **Last Updated**: 2021-06-10 +- **Author**: Michael Haag, Splunk +- **ID**: 85bc3f30-ca28-11eb-bd21-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution | + +#### Search + +``` +`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_loading_dotnet_into_memory_via_reflection_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that `powershell_loading_dotnet_into_memory_via_reflection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Message +* OpCode +* ComputerName +* User +* EventCode + + +#### How To Implement +To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. + +#### Known False Positives +False positives should be limited as day to day scripts do not use this method. + +#### Associated Analytic story +* [Malicious PowerShell](/stories/malicious_powershell) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ | + + + + +#### Reference + +* [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0) +* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.) +* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63) +* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf) +* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md index e7c2804f33..d282bf9148 100644 --- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md +++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 0d718b52-c9f1-11eb-bc61-acde48001122 @@ -54,8 +55,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_processing_stream_of_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md index bc936fcf5a..9c3ef534cb 100644 --- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md +++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: c396a0c4-c9f2-11eb-b4f5-acde48001122 @@ -49,8 +50,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_using_memory_as_backing_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md index 1efc423d08..3d15f8a8ef 100644 --- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md +++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 7742aa92-c9d9-11eb-bbfc-acde48001122 diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md index 9541b43a1e..3d5539130d 100644 --- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md +++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 28077620-c9f6-11eb-8785-acde48001122 @@ -49,8 +50,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `recon_avproduct_through_pwh_or_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md index 778f1acd35..bbd7ea609a 100644 --- a/docs/_posts/2021-06-10-recon_using_wmi_class.md +++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 018c1972-ca07-11eb-9473-acde48001122 @@ -49,8 +50,8 @@ The following analytic identifies suspicious PowerShell via EventCode 4104, wher #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `recon_using_wmi_class_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md index 9d2bcefe44..4cd0407e3e 100644 --- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md +++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-14 - **Author**: Teoderick Contreras, Splunk - **ID**: b5cd5526-cce7-11eb-b3bd-acde48001122 @@ -49,8 +50,8 @@ The following analytic identifies suspicious PowerShell script execution via Eve #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `wmi_recon_running_process_or_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md index ff57d0095c..73f5a6d0a6 100644 --- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md +++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -35,7 +35,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-16 - **Author**: Michael Haag, Splunk - **ID**: 01d9a0c2-cece-11eb-ab46-acde48001122 diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md index 825c94f3a9..2d103db694 100644 --- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md +++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-06-17 - **Author**: Mauricio Velazco, Splunk - **ID**: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40 @@ -54,8 +55,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `suspicious_event_log_service_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md index 295654979b..99e7c98439 100644 --- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md +++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will identify suspicious process of cscript.exe where it tries to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: dc64d064-d346-11eb-8588-acde48001122 diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md index 4f149afec0..46e15e314f 100644 --- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md +++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: afed80b2-d34b-11eb-a952-acde48001122 @@ -55,8 +56,8 @@ This search is to detect a suspicious enabling of smb1protocol through "powershe #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_enable_smb1protocol_feature_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md index ff4afe78bf..fe8089df42 100644 --- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md +++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious commandline designed to delete files or di - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-22 - **Author**: Teoderick Contreras, Splunk - **ID**: ba570b3a-d356-11eb-8358-acde48001122 @@ -56,8 +57,8 @@ This search is to detect a suspicious commandline designed to delete files or di #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `recursive_delete_of_directory_in_batch_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md index 0dc61a4800..1bdefb096f 100644 --- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious modification of firewall to allow file and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-23 - **Author**: Teoderick Contreras, Splunk - **ID**: ce27646e-d411-11eb-8a00-acde48001122 diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md index 28c39e0bbf..a1e053a2dc 100644 --- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md +++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious modification to the firewall to allow netw - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-23 - **Author**: Teoderick Contreras, Splunk - **ID**: ccd6a38c-d40b-11eb-85a5-acde48001122 diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md index d696bc6890..f7791092bc 100644 --- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md +++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-06-24 - **Author**: Teoderick Contreras, Splunk - **ID**: cb6b339e-d4c6-11eb-a026-acde48001122 diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md index bd453e4f23..e2c2037d60 100644 --- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md +++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This detection targets behaviors observed when threat actors have used sc.exe to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-06-25 - **Author**: Michael Hart, Splunk - **ID**: 77592bec-d5cc-11eb-9e60-acde48001122 diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md index 0ec1561853..c7a634f250 100644 --- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md +++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: 313681a2-da8e-11eb-adad-acde48001122 @@ -61,8 +62,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) Note that `print_spooler_adding_a_printer_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md index 478d412a6f..7f4387b2b7 100644 --- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md +++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -37,6 +37,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 1adc9548-da7c-11eb-8f13-acde48001122 @@ -62,8 +63,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu #### Macros The SPL above uses the following Macros: -* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml) Note that `print_spooler_failed_to_load_a_plug-in_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md index 4148848629..b5e814e929 100644 --- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md +++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 15d905f6-da6b-11eb-ab82-acde48001122 @@ -59,9 +60,9 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `spoolsv_spawning_rundll32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md index 293703e15a..2e9c0ee649 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ This search is to detect suspicious loading of dll in specific path relative to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: a5e451f8-da81-11eb-b245-acde48001122 diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md index 3abb2b0b17..bb05314bf1 100644 --- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md +++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk - **ID**: 799b606e-da81-11eb-93f8-acde48001122 diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md index a2d8aca6da..e3714b0ca4 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: d5bf5cf2-da71-11eb-92c2-acde48001122 diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md index af8e8ee588..b040161cab 100644 --- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md +++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-01 - **Author**: Mauricio Velazco, Michael Haag, Splunk - **ID**: 347fd388-da87-11eb-836d-acde48001122 diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md index 5b94d55a6b..fb35d74468 100644 --- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md +++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-05 - **Author**: Teoderick Contreras, Splunk - **ID**: 8bb3f280-dd9b-11eb-84d5-acde48001122 diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md index 2655095be0..42ddd7621a 100644 --- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md +++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identifies a modification in registry to disable the windows d - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-05 - **Author**: Michael Haag, Splunk - **ID**: c148a894-dd93-11eb-bf2a-acde48001122 @@ -56,9 +57,9 @@ This search is to identifies a modification in registry to disable the windows d #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `powershell_disable_security_monitoring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md index b0736b1ef7..b3c9ea04b5 100644 --- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md +++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 7f04349c-e30d-11eb-bc7f-acde48001122 diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md index b5f0ef8b90..7438decb2d 100644 --- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md +++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search looks for cloud compute instances created by users who have not crea - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change) +- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719) - **Last Updated**: 2021-07-13 - **Author**: Rico Valdez, Splunk - **ID**: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md index 6e7e12ee3c..640bca456a 100644 --- a/docs/_posts/2021-07-19-aws_createloginprofile.md +++ b/docs/_posts/2021-07-19-aws_createloginprofile.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-07-19 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf444d111 diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md index a7af78d89d..c88c7299fe 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-07-19 - **Author**: Bhavin Patel, Patrick Bareiss, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4 diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md index c55278307d..a723f3dbc1 100644 --- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md +++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-07-19 - **Author**: Patrick Bareiss, Splunk - **ID**: 39c61d09-8b30-4154-922b-2d0a694ecc22 diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md index 629caf751b..cd37155fef 100644 --- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md +++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 4aa5d062-e893-11eb-9eb2-acde48001122 @@ -56,10 +57,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `mshta_spawning_rundll32_or_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -87,6 +88,7 @@ limitted. this anomaly behavior is not commonly seen in clean host. #### Associated Analytic story * [Trickbot](/stories/trickbot) * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md index f20e6851cb..5ae22ad65e 100644 --- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md +++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to detect a suspicious office product process that spawn cmd chil - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-19 - **Author**: Teoderick Contreras, Splunk - **ID**: b8b19420-e892-11eb-9244-acde48001122 @@ -56,8 +57,8 @@ this search is to detect a suspicious office product process that spawn cmd chil #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `office_product_spawn_cmd_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md index 97258bfee8..52501d629f 100644 --- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md +++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes AWS CloudTrail events to identify when an EC2 sn - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-07-20 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md index c5bc0e20e1..229b31947e 100644 --- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md +++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-07-21 - **Author**: Michael Haag, Splunk - **ID**: 9251299c-ea5b-11eb-a8de-acde48001122 @@ -57,8 +58,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_copy_of_shadowcopy_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md index 1dfb3dfd9d..f413d93219 100644 --- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md +++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following analytic identifies access to SAM, SYSTEM or SECURITY databases' w - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-23 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: 57551656-ebdb-11eb-afdf-acde48001122 diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md index 8a14a8a647..29e149415d 100644 --- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md +++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: f8a22586-ee2d-11eb-a193-acde48001122 @@ -75,6 +76,7 @@ unknown #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md index 6cf42404ff..ff94b3dc3e 100644 --- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md +++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious rundll32 process that drops executable (.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 6338266a-ee2a-11eb-bf68-acde48001122 @@ -77,6 +78,7 @@ unknown #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md index 0ee687b40b..bac9d98850 100644 --- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md +++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: bed761f8-ee29-11eb-8bf3-acde48001122 @@ -56,9 +57,9 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `suspicious_icedid_rundll32_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ limitted. this parameter is not commonly used by windows application but can be #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md index 85fb8e4897..be42c08207 100644 --- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md +++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious rundll32.exe process with plugininit param - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 92d51712-ee29-11eb-b1ae-acde48001122 @@ -56,9 +57,9 @@ This search is to detect a suspicious rundll32.exe process with plugininit param #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `suspicious_rundll32_plugininit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md index 9911265f85..a70078c3a7 100644 --- a/docs/_posts/2021-07-27-chcp_command_execution.md +++ b/docs/_posts/2021-07-27-chcp_command_execution.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect execution of chcp.exe application. this utility is used - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 21d236ec-eec1-11eb-b23e-acde48001122 diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md index 7ec28dc602..aae3d55fd1 100644 --- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md +++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-27 - **Author**: Teoderick Contreras, Splunk - **ID**: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 @@ -89,6 +90,7 @@ minimal. but network operator can use this application to load dll. * [IcedID](/stories/icedid) * [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) * [Remcos](/stories/remcos) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md index 556268c64f..8bed0ef8ce 100644 --- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md +++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 2dbeee3a-f067-11eb-96c0-acde48001122 @@ -75,6 +76,7 @@ unknown #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md index d1505397de..f3aa909358 100644 --- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md +++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: b7a045fc-f14a-11eb-8e79-acde48001122 diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md index 2d358c75bb..73edb54ec4 100644 --- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md +++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious file creation namely passff.tar and cookie - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: 0db4da70-f14b-11eb-8043-acde48001122 diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md index 449d28133e..a39527934a 100644 --- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md +++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this detection was designed to identifies suspicious spawned process of known MS - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-07-30 - **Author**: Teoderick Contreras, Splunk - **ID**: 2d9fc90c-f11f-11eb-9300-acde48001122 diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md index 18f93082e7..d4709062ea 100644 --- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md +++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-03 - **Author**: Teoderick Contreras, Splunk - **ID**: 0f216a38-f45f-11eb-b09c-acde48001122 diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md index 01431c1cc4..57e51ae7aa 100644 --- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md +++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This search is to detect suspicious process injection in command shell. This tec - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 10399c1e-f51e-11eb-b920-acde48001122 diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md index 4789041953..44592607d6 100644 --- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md +++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious un-installation of application using msiex - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-09 - **Author**: Teoderick Contreras, Splunk - **ID**: 1fca2b28-f922-11eb-b2dd-acde48001122 diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md index e5a5b2d159..3e00e356d5 100644 --- a/docs/_posts/2021-08-10-powershell_execute_com_object.md +++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a COM CLSID execution through powershell. This techniqu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 65711630-f9bf-11eb-8d72-acde48001122 @@ -57,8 +58,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_execute_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md index 68609f221e..b438c86f07 100644 --- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md +++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 4e5e024e-fabb-11eb-8b8f-acde48001122 diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md index 652a9b1994..b49979b3c1 100644 --- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md +++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 2bcccd20-fc2b-11eb-8d22-acde48001122 diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md index 09924a1c90..e83e92c30e 100644 --- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md +++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is to detect suspicious google drive or google docs files shared out - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-16 - **Author**: Teoderick Contreras, Splunk - **ID**: f6ee02d6-fea0-11eb-b2c2-acde48001122 diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md index 1311c9b691..abe4e80f08 100644 --- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md +++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 6d663014-fe92-11eb-ab07-acde48001122 diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md index 83d673673e..4460b9bbea 100644 --- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md +++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious 7z process with commandline pointing to SM - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 01d29b48-ff6f-11eb-b81e-acde48001122 diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md index 9104978fe9..6534106970 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: 62721bd2-1d82-4623-b6e6-aac170014423 diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md index d042c13ec0..a1f5018c4f 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: cbc95e44-7c22-443f-88fd-0424478f5589 diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md index 6999ea1880..41416c92f7 100644 --- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md +++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-17 - **Author**: Patrick Bareiss, Splunk - **ID**: 0b80e2c8-c746-4ddb-89eb-9efd892220cf diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md index ec8ed340f9..1b5e7f076a 100644 --- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md +++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-17 - **Author**: Teoderick Contreras, Stanislav Miskovic, Splunk - **ID**: dc4dc3a8-ff54-11eb-8bf7-acde48001122 diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md index 6cbe4f2210..f0d4a0e5da 100644 --- a/docs/_posts/2021-08-18-esentutl_sam_copy.md +++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the process - `esentutl.exe` - being used to c - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-18 - **Author**: Michael Haag, Splunk - **ID**: d372f928-ce4f-11eb-a762-acde48001122 @@ -56,9 +57,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `esentutl_sam_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ False positives should be limited. Filter as needed. #### Associated Analytic story * [Credential Dumping](/stories/credential_dumping) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md index d5f1d74cee..6498c46a10 100644 --- a/docs/_posts/2021-08-18-powershell_4104_hunting.md +++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following Hunting analytic assists with identifying suspicious PowerShell ex - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-18 - **Author**: Michael Haag, Splunk - **ID**: d6f2b006-0041-11ec-8885-acde48001122 diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md index 505a37283a..0909632f37 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-19 - **Author**: Patrick Bareiss, Splunk - **ID**: d4c4d4eb-3994-41ca-a25e-a82d64e125bb diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md index 8087776d55..718ae1d5ce 100644 --- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md +++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-19 - **Author**: Patrick Bareiss, Splunk - **ID**: 300688e4-365c-4486-a065-7c884462b31d @@ -58,8 +59,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service ( #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml) Note that `aws_ecr_container_upload_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md index 1c52810668..28df98f938 100644 --- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md +++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is to detect a gsuite email contains suspicious subject having known - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ef3971e-00f2-11ec-b54f-acde48001122 diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md index 122839827c..f7af144dd3 100644 --- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md +++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md @@ -17,7 +17,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,6 +26,7 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2021-08-19 - **Author**: Rico Valdez, Splunk - **ID**: 6923cd64-17a0-453c-b945-81ac2d8c6db9 diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md index 69cf151c0b..bb61207dd1 100644 --- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md +++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search is to detect a pushed or commit to master or main branch. This is to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-20 - **Author**: Teoderick Contreras, Splunk - **ID**: c9d2bfe2-019f-11ec-a8eb-acde48001122 diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md index b49558dc00..96855dfdf6 100644 --- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md +++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-20 - **Author**: Patrick Bareiss, Splunk - **ID**: 0f83244b-425b-4528-83db-7a88c5f66e48 @@ -56,8 +57,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect l #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `kubernetes_nginx_ingress_lfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md index 55a1e42445..87a0a53e5c 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 85fae8fa-0427-11ec-8b78-acde48001122 diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md index 0ea29c85d3..0b44a30d9d 100644 --- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 2e891cbe-0426-11ec-9c9c-acde48001122 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getlocaluser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md index 40ea9b1939..4e9a03ae6f 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: b44f6ac6-0429-11ec-87e9-acde48001122 diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md index 8c0cbd3a28..321584a47f 100644 --- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md +++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 640b0eda-0429-11ec-accd-acde48001122 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getwmiobject_user_account_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md index 29ad6e1ee9..14e416b243 100644 --- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md +++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 8630aa22-042b-11ec-af39-acde48001122 diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md index 20d40e4c48..4f079e05eb 100644 --- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md +++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search is to detect a shared file in google drive with suspicious file name - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 07eed200-03f5-11ec-98fb-acde48001122 diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md index 3598463a27..ab6c4eaf9c 100644 --- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md +++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-23 - **Author**: Patrick Bareiss, Splunk - **ID**: fc5531ae-62fd-4de6-9c36-b4afdae8ca95 @@ -56,8 +57,8 @@ This search uses the Kubernetes logs from a nginx ingress controller to detect r #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [kubernetes_container_controller](https://github.com/splunk/security_content/blob/develop/macros/kubernetes_container_controller.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `kubernetes_nginx_ingress_rfi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md index 289eace8d7..f065f89f8a 100644 --- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md +++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: de7fcadc-04f3-11ec-a241-acde48001122 @@ -54,8 +55,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `adsisearcher_account_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md index c0cb3747fe..200b9a0b43 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: b1a8ce04-04c2-11ec-bea7-acde48001122 diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md index c452aef397..f4039861da 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 98f6a534-04c2-11ec-96b2-acde48001122 @@ -56,8 +57,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `domain_account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md index 9b5d335fdf..bc94ed43f5 100644 --- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md +++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 383572e0-04c5-11ec-bdcc-acde48001122 diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md index b21be35369..f8bb924fc5 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Michael Haag, Splunk - **ID**: 4fa7f846-054a-11ec-a836-acde48001122 diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md index f2cc0eca68..e44415d4a2 100644 --- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Michael Haag, Splunk - **ID**: 89275e7e-0548-11ec-bf75-acde48001122 @@ -51,8 +52,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get-domaintrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md index 9354220af4..4902ce1faf 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 0b6ee3f4-04e3-11ec-a87d-acde48001122 diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md index 80697120a4..702e2e756b 100644 --- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 21432e40-04f4-11ec-b7e6-acde48001122 @@ -54,8 +55,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_aduser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md index 73f91a9f6c..e3a8c35ebe 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 9a5a41d6-04e7-11ec-923c-acde48001122 diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md index c90b1891d2..623bf28a5d 100644 --- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 61994268-04f4-11ec-865c-acde48001122 @@ -54,8 +55,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_domainuser_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md index 19321d6037..441c9b484e 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 22d3b118-04df-11ec-8fa3-acde48001122 diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md index 2b267e57f0..6e8a40b9fc 100644 --- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md +++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: fabd364e-04f3-11ec-b34b-acde48001122 @@ -54,8 +55,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getwmiobject_ds_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md index eabdd6dff0..a308c7ad19 100644 --- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md +++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-24 - **Author**: Patrick Bareiss, Splunk - **ID**: 4890cd6b-0112-4974-a272-c5c153aee551 diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md index fb011dd490..89323a7af8 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `domain_group_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md index ca1d24a24b..75d58e79dd 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `net.exe` with command-line arguments u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md index d90bdc7d39..b7ba2c6750 100644 --- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: a87736a6-95cd-4728-8689-3c64d5026b3e diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md index 0bb67a96eb..f302935a35 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md index 98b867edf9..0709fa4575 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 10d62950-0de5-4199-a710-cff9ea79b413 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `elevated_group_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md index c075198c2e..dfa3d7a1a7 100644 --- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md +++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md index df3f5fff13..fc660e0b61 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 872e3063-0fc4-4e68-b2f3-f2b99184a708 diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md index 4f469681ad..b17a67b244 100644 --- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: e4c73d68-794b-468d-b4d0-dac1772bbae7 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getadgroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md index 6b2c097070..133978adf3 100644 --- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md +++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 93c94be3-bead-4a60-860f-77ca3fe59903 diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md index 32c59b7d12..89af756864 100644 --- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md +++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line util - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: e02af35c-1de5-4afe-b4be-f45aba57272b diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md index 150d0f8f9c..2b018290fa 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: df275a44-4527-443b-b884-7600e066e3eb diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md index 6d614b03f5..9e4855a7f6 100644 --- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md +++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-25 - **Author**: Mauricio Velazco, Splunk - **ID**: 67740bd3-1506-469c-b91d-effc322cc6e5 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getwmiobject_ds_group_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md index 0970c0f1e4..4409899bbd 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 36e46ebe-065a-11ec-b4c7-acde48001122 diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md index a854a001e2..fdbc10924a 100644 --- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 1ff7ccc8-065a-11ec-91e4-acde48001122 @@ -49,8 +50,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md index 429a4442e5..325a8fe002 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 8b5ef342-065a-11ec-b0fc-acde48001122 diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md index c13460fefa..0ad2e9884b 100644 --- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, MAuricio Velazco, Splunk - **ID**: 737e1eb0-065a-11ec-921a-acde48001122 @@ -49,8 +50,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md index 17ea6bf22e..bee88d9cd2 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: b8f9947e-065a-11ec-aafb-acde48001122 diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md index 277c75323b..8345607899 100644 --- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Splunk - **ID**: a360d2b2-065a-11ec-b0bf-acde48001122 @@ -49,8 +50,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_domainpolicy_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md index 32f407e4d5..4805f8d820 100644 --- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md +++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-26 - **Author**: Mauricio Velazco, Splunk - **ID**: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getdomaingroup_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md index a362e74ed8..79998c9c58 100644 --- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md +++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-26 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 09336538-065a-11ec-8665-acde48001122 diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md index 006a9f31a4..bcb93c7faa 100644 --- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md +++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `* - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-26 - **Author**: Jose Hernandez, Splunk - **ID**: 5d814af1-1041-47b5-a9ac-d754e82e9a26 diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md index 259fee6fe6..d19871fff0 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md +++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ Review the source attempting to perform this activity against your environment. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-27 - **Author**: Michael Haag, Splunk - **ID**: 29228ab4-0762-11ec-94aa-acde48001122 @@ -56,8 +57,8 @@ Review the source attempting to perform this activity against your environment. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `exchange_powershell_abuse_via_ssrf_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md index 431cb8dc26..0b2972243b 100644 --- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md +++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,7 +33,8 @@ Module - New-managementroleassignment can assign a management role to a manageme - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-27 - **Author**: Michael Haag - **ID**: 2d10095e-05ae-11ec-8fdf-acde48001122 @@ -59,8 +60,8 @@ Module - New-managementroleassignment can assign a management role to a manageme #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `exchange_powershell_module_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md index 4f758221b3..81b680c398 100644 --- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md +++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `nltest.exe` with command-line argument - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-08-30 - **Author**: Mauricio Velazco, Splunk - **ID**: 41243735-89a7-4c83-bcdd-570aa78f00a1 diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md index f10bf71b0d..4e461dad75 100644 --- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md +++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-30 - **Author**: Mauricio Velazco, Splunk - **ID**: 9df16706-04a2-41e2-bbfe-9b38b34409d3 diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md index 91a477890f..0e1c071c27 100644 --- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md +++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,7 +29,8 @@ During triage, review parallel security events to identify further suspicious ac - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-31 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: 95b8061a-0a67-11ec-85ec-acde48001122 @@ -53,8 +54,8 @@ During triage, review parallel security events to identify further suspicious ac #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `petitpotam_network_share_access_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md index 8995b43e47..fe0e63a619 100644 --- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md +++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,7 +26,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-08-31 - **Author**: Michael Haag, Mauricio Velazco, Splunk - **ID**: e3ef244e-0a67-11ec-abf2-acde48001122 @@ -50,8 +51,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `petitpotam_suspicious_kerberos_tgt_request_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md index ad08b8e27a..ac348f75b1 100644 --- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md +++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-08-31 - **Author**: Mauricio Velazco, Splunk - **ID**: 9fb562f4-42f8-4139-8e11-a82edf7ed718 diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md index 3027360a77..eacf6237b4 100644 --- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md +++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for disable security step in CircleCI pipeline. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97 @@ -60,8 +61,8 @@ This search looks for disable security step in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) Note that `circle_ci_disable_security_step_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md index 815503a673..0a19282601 100644 --- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md index b543564cd4..f68c15444b 100644 --- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md +++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: f0c9d62f-a232-4edd-b17e-bc409fb133d4 diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md index 1eb5a05e7e..9af4c165b9 100644 --- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: a9a1da02-8e27-4bf7-a348-f4389c9da487 @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getadcomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md index dd909e9090..585a52d858 100644 --- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 29b99201-723c-4118-847a-db2b3d3fb8ea @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getwmiobject_ds_computer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md index fbf6397c10..c1d9289f34 100644 --- a/docs/_posts/2021-09-01-github_commit_in_develop.md +++ b/docs/_posts/2021-09-01-github_commit_in_develop.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Teoderick Contreras, Splunk - **ID**: f3030cb6-0b02-11ec-8f22-acde48001122 diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md index f47f9bf6a9..b2a1d869e0 100644 --- a/docs/_posts/2021-09-01-github_dependabot_alert.md +++ b/docs/_posts/2021-09-01-github_dependabot_alert.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for Dependabot Alerts in Github logs. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 05032b04-4469-4034-9df7-05f607d75cba diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md index c3accd20ac..9d68f6b235 100644 --- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md +++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for Pull Request from unknown user. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Patrick Bareiss, Splunk - **ID**: 9d7b9100-8878-4404-914e-ca5e551a641e @@ -58,8 +59,8 @@ This search looks for Pull Request from unknown user. #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml) +* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml) Note that `github_pull_request_from_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md index cad2860d70..c4cd6cd06f 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 70803451-0047-4e12-9d63-77fa7eb8649c @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `remote_system_discovery_with_adsisearcher_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md index f74622a1dd..f02807f18c 100644 --- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md +++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-01 - **Author**: Mauricio Velazco, Splunk - **ID**: d82eced3-b1dc-42ab-859e-a2fc98827359 diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md index dad3c9a21e..efbf4e4ada 100644 --- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md +++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search looks for disable security job in CircleCI pipeline. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-02 - **Author**: Patrick Bareiss, Splunk - **ID**: 4a2fdd41-c578-4cd4-9ef7-980e352517f2 @@ -56,8 +57,8 @@ This search looks for disable security job in CircleCI pipeline. #### Macros The SPL above uses the following Macros: -* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [circleci](https://github.com/splunk/security_content/blob/develop/macros/circleci.yml) Note that `circle_ci_disable_security_job_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md index d1c440121d..f193025325 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-02 - **Author**: Michael Haag, Splunk - **ID**: 584f4884-0bf1-11ec-a5ec-acde48001122 diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md index 5374a066f0..7ea896e9ee 100644 --- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-02 - **Author**: Michael Haag, Splunk - **ID**: 70fac80e-0bf1-11ec-9ba0-acde48001122 @@ -51,8 +52,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get-foresttrust_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md index ec50022e4f..c082707000 100644 --- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-02 - **Author**: Mauricio Velazco, Splunk - **ID**: f64da023-b988-4775-8d57-38e512beb56e @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getdomaincomputer_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md index 85a1d3c781..7fbb511200 100644 --- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md +++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-02 - **Author**: Mauricio Velazco, Splunk - **ID**: 676b600a-a94d-4951-b346-11329431e6c1 @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getdomaincontroller_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md index 0ec8979f92..a6dc7c5ae1 100644 --- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md +++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious bcdedit commandline to configure the host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-06 - **Author**: Teoderick Contreras, Splunk - **ID**: dc7a8004-0f18-11ec-8c54-acde48001122 diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md index 0e3578521e..6450cb4920 100644 --- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md +++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious bcdedit commandline to configure the host - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 81f1dce0-0f18-11ec-a5d7-acde48001122 diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md index 1abc2e8848..0b772e48cf 100644 --- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search correlations detections by repository and risk_score - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 8da9fdd9-6a1b-4ae0-8a34-8c25e6be9687 diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md index 6e8c54b63d..868cdd6910 100644 --- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md +++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search correlations detections by user and risk_score - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-06 - **Author**: Patrick Bareiss, Splunk - **ID**: 610e12dc-b6fa-4541-825e-4a0b3b6f6773 diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md index b0051ced4d..262f573ad3 100644 --- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: c5a31f80-5888-4d81-9f78-1cc65026316e diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md index 2ea7a8f834..0be25a3ee4 100644 --- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: ed550c19-712e-43f6-bd19-6f58f61b3a5e diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md index dc2a880d09..286aa7e56b 100644 --- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md +++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 868ee0e4-52ab-484a-833a-6d85b7c028d0 diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md index c110695866..836f811c00 100644 --- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md +++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md index 1abc149da2..be26063d31 100644 --- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md +++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect an application try to connect and create ADSI Object - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-07 - **Author**: Teoderick Contreras, Splunk - **ID**: 991eb510-0fc6-11ec-82d3-acde48001122 diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md index 4013524077..d1bd0c57d9 100644 --- a/docs/_posts/2021-09-07-system_information_discovery_detection.md +++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ Detect system information discovery techniques used by attackers to understand c - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-07 - **Author**: Patrick Bareiss, Splunk - **ID**: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md index e3baa3cb0c..f7e3717d39 100644 --- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md +++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following detection identifies control.exe loading either a .cpl or .inf fro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 10423ac4-10c9-11ec-8dc4-acde48001122 @@ -84,6 +85,7 @@ Limited false positives will be present as control.exe does not natively load fr #### Associated Analytic story * [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md index 26f1885005..db9d6bebe0 100644 --- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md +++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for the creation of local administrator accounts using net.exe - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Bhavin Patel, Splunk - **ID**: b89919ed-fe5f-492c-b139-151bb162040e diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md index 44f03309c0..a6cda175c7 100644 --- a/docs/_posts/2021-09-08-office_spawning_control.md +++ b/docs/_posts/2021-09-08-office_spawning_control.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following detection identifies control.exe spawning from an office product. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 053e027c-10c7-11ec-8437-acde48001122 diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md index e0187aaf9a..7ff3c47836 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: c8e7ced0-10c5-11ec-8b03-acde48001122 @@ -57,9 +58,9 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `rundll32_control_rundll_hunt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -86,6 +87,7 @@ This is a hunting detection, meant to provide a understanding of how voluminous #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) * [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md index 866becdfe5..81e5750d8d 100644 --- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md +++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following detection identifies rundll32.exe with `control_rundll` within the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-08 - **Author**: Michael Haag, Splunk - **ID**: 1adffe86-10c3-11ec-8ce6-acde48001122 @@ -57,9 +58,9 @@ The following detection identifies rundll32.exe with `control_rundll` within the #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `rundll32_control_rundll_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -86,6 +87,7 @@ This may be tuned, or a new one related, by adding .cpl to command-line. However #### Associated Analytic story * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) * [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md index d57354b984..cc0f3fb132 100644 --- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md +++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-09 - **Author**: Michael Haag, Splunk - **ID**: 8bbb7d58-b360-11eb-ba21-acde48001122 @@ -56,9 +57,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `extraction_of_registry_hives_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md index 9e58442b1a..9ae8ae4dc4 100644 --- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md +++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following detection identifies the module load of mshtml.dll into an Office - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-09 - **Author**: Michael Haag, Splunk - **ID**: 5f1c168e-118b-11ec-84ff-acde48001122 diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md index 370df8a6c8..ca4b6e331e 100644 --- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md +++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 091712ff-b02a-4d43-82ed-34765515d95d @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getnettcpconnection_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md index c244645f49..66aaad292d 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: ae008c0f-83bd-4ed4-9350-98d4328e15d2 diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md index a9229c3fce..d80bc07f6a 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `net.exe` with command-line arguments u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md index a2c04a9b91..cdd50f112c 100644 --- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md +++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 2cf5cc25-f39a-436d-a790-4857e5995ede diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md index 34ee04845d..2d4c64a21e 100644 --- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md +++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following analytic identifies behavior related to CVE-2021-40444. Whereas th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-10 - **Author**: Michael Haag, Splunk - **ID**: f48cd1d4-125a-11ec-a447-acde48001122 diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md index b636972c17..7f0b4e026e 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 7eb9c3d5-c98c-4088-acc5-8240bad15379 diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md index 95b151ecd3..f2d7385893 100644 --- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md +++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 80879283-c30f-44f7-8471-d1381f6d437a @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `getcurrent_user_with_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md index d44db66c59..38bb145871 100644 --- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md +++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a execution of jscript using cscript process. Commonly - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 002f1e24-146e-11ec-a470-acde48001122 diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md index aa77440f29..87c84d1a97 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 0b0c40dc-14a6-11ec-b267-acde48001122 diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md index 7b6b5aecaf..77e09a0e83 100644 --- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md +++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 2eba3d36-14a6-11ec-a682-acde48001122 diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md index 896cdac9f6..ae032ca54b 100644 --- a/docs/_posts/2021-09-13-office_application_drop_executable.md +++ b/docs/_posts/2021-09-13-office_application_drop_executable.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious MS office application that drop or create - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Michael Haag Splunk - **ID**: 73ce70c4-146d-11ec-9184-acde48001122 diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md index 9eaa2763c0..3ca8d926e0 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `query.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: ad03bfcf-8a91-4bc2-a500-112993deba87 diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md index 628c45ca50..82d8e67ae8 100644 --- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md +++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md index 04c6ccf418..b72d4ff517 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` with command-line argu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 0cdf318b-a0dd-47d7-b257-c621c0247de8 diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md index 67d24e9b44..f039b6d66f 100644 --- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md +++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-13 - **Author**: Mauricio Velazco, Splunk - **ID**: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20 @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `user_discovery_with_env_vars_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md index 737946a6ba..dd2aba13e3 100644 --- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md +++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-13 - **Author**: Teoderick Contreras, Splunk - **ID**: 004e32e2-146d-11ec-a83f-acde48001122 diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md index ea29530852..f4db6c0335 100644 --- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md +++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies a non-standard parent process (not matching CM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-14 - **Author**: Teoderick Contreras, Splunk - **ID**: 6c3f7dd8-153c-11ec-ac2d-acde48001122 diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md index 703a994fd8..9f30914cbe 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 5434f670-155d-11ec-8cca-acde48001122 diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md index 961649154d..89f893e957 100644 --- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 69df7f7c-155d-11ec-a055-acde48001122 @@ -56,8 +57,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `get_wmiobject_group_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md index a0f0425034..8099831fc0 100644 --- a/docs/_posts/2021-09-14-net_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following hunting analytic will identify the use of localgroup discovery usi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 54f5201e-155b-11ec-a6e2-acde48001122 diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md index 72c30e8451..42a4924419 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following hunting analytic identifies the use of `get-localgroup` being used - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: b71adfcc-155b-11ec-9413-acde48001122 diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md index d7a9f25ddf..deaee52480 100644 --- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md +++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: d7c6ad22-155c-11ec-bb64-acde48001122 @@ -56,8 +57,8 @@ During triage, review parallel processes using an EDR product or 4688 events. It #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_get_localgroup_discovery_with_script_block_logging_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md index 9fa586ad23..819b24538a 100644 --- a/docs/_posts/2021-09-14-wmic_group_discovery.md +++ b/docs/_posts/2021-09-14-wmic_group_discovery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ During triage, review parallel processes and identify any further suspicious beh - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-14 - **Author**: Michael Haag, Splunk - **ID**: 83317b08-155b-11ec-8e00-acde48001122 diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md index 9a167c811b..af97af64b5 100644 --- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md +++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: a9079b18-1633-11ec-859c-acde48001122 diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md index 36b9ab07f2..fb31b99c51 100644 --- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md +++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect an anomaly event of non-chrome process accessing the fi - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: 81263de4-160a-11ec-944f-acde48001122 @@ -55,8 +56,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `non_chrome_process_accessing_chrome_default_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md index 2ed8cd7740..7f5cba781c 100644 --- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md +++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect an anomaly event of non-firefox process accessing the f - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-15 - **Author**: Teoderick Contreras, Splunk - **ID**: e6fc13b0-1609-11ec-b533-acde48001122 @@ -55,8 +56,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `non_firefox_process_access_firefox_profile_dir_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md index 9dc6368809..fdbe633a96 100644 --- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md +++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to detect a potential account discovery series of command used by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 339805ce-ac30-11eb-b87d-acde48001122 @@ -57,8 +58,8 @@ this search is to detect a potential account discovery series of command used by #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md index 57bbe8f4d2..2d608e4c58 100644 --- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md +++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Attempt To Add Certificate To Untrusted Store - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Rico Valdez, Splunk - **ID**: 6bc5243e-ef36-45dc-9b12-f4a6be131159 diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md index 3d6f71b01f..c76efdcef3 100644 --- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md +++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 @@ -56,10 +57,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md index 748e5f25db..c42d3e881c 100644 --- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md +++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The search looks for a batch file (.bat) written to the Windows system directory - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Rico Valdez, Splunk - **ID**: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md index 02ed7dc4e3..6f8d11e1fa 100644 --- a/docs/_posts/2021-09-16-bits_job_persistence.md +++ b/docs/_posts/2021-09-16-bits_job_persistence.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following query identifies Microsoft Background Intelligent Transfer Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: e97a5ffe-90bf-11eb-928a-acde48001122 @@ -81,6 +82,7 @@ Limited false positives will be present. Typically, applications will use `BitsA #### Associated Analytic story * [BITS Jobs](/stories/bits_jobs) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md index 630dbd4642..1b67c01d47 100644 --- a/docs/_posts/2021-09-16-bitsadmin_download_file.md +++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following query identifies Microsoft Background Intelligent Transfer Service - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 80630ff4-8e4c-11eb-aab5-acde48001122 @@ -88,6 +89,7 @@ Limited false positives, however it may be required to filter based on parent pr * [Ingress Tool Transfer](/stories/ingress_tool_transfer) * [BITS Jobs](/stories/bits_jobs) * [DarkSide Ransomware](/stories/darkside_ransomware) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md index f042054d67..2cd0e02b5a 100644 --- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md +++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search detects the use of wmic and Powershell to create a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: 2ed8b538-d284-449a-be1d-82ad1dbd186b @@ -57,9 +58,9 @@ This search detects the use of wmic and Powershell to create a shadow copy. #### Macros The SPL above uses the following Macros: * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `creation_of_shadow_copy_with_wmic_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -86,6 +87,7 @@ Legtimate administrator usage of wmic to create a shadow copy. #### Associated Analytic story * [Credential Dumping](/stories/credential_dumping) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md index dd5eeec675..d6ed0543ec 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search detects credential dumping using copy command from a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: d8c406fe-23d2-45f3-a983-1abe7b83ff3b @@ -56,8 +57,8 @@ This search detects credential dumping using copy command from a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `credential_dumping_via_copy_command_from_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md index b7d97c7841..dbf72b44c2 100644 --- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md +++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search detects the creation of a symlink to a shadow copy. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Patrick Bareiss, Splunk - **ID**: c5eac648-fae0-4263-91a6-773df1f4c903 @@ -56,8 +57,8 @@ This search detects the creation of a symlink to a shadow copy. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `credential_dumping_via_symlink_to_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md index be2b853d11..3708c2488b 100644 --- a/docs/_posts/2021-09-16-detect_html_help_renamed.md +++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 62fed254-513b-460e-953d-79771493a9f3 @@ -56,9 +57,9 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_html_help_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely a renamed instance of hh.exe will be used legitimately, filter #### Associated Analytic story * [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md index 54acb75a73..d629c4cf11 100644 --- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 8c5835b9-39d9-438b-817c-95f14c69a31e @@ -56,9 +57,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_html_help_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may retrieve a CHM remotely, fil #### Associated Analytic story * [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md index d1bcf5614a..20567e0eb8 100644 --- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md +++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 0b2eefa5-5508-450d-b970-3dd2fb761aec @@ -56,9 +57,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_html_help_using_infotech_storage_handlers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ It is rare to see instances of InfoTech Storage Handlers being used, but it does #### Associated Analytic story * [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md index 3306242505..d566ef3ddc 100644 --- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md +++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies "mshta.exe" execution with inline protocol han - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Bhavin Patel, Michael Haag, Splunk - **ID**: a0873b32-5b68-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_mshta_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may exhibit this behavior, trigg #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md index 4b0573810f..84317e5c12 100644 --- a/docs/_posts/2021-09-16-detect_mshta_renamed.md +++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 8f45fcf0-5b68-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_mshta_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ Although unlikely, some legitimate applications may use a moved copy of mshta.ex #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md index 41cf864318..7c90130fee 100644 --- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md +++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 9b3af1e6-5b68-11eb-ae93-0242ac130002 @@ -56,9 +57,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `detect_mshta_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -85,6 +86,7 @@ It is possible legitimate applications may perform this behavior and will need t #### Associated Analytic story * [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md index 1018da2b08..06e6c4a541 100644 --- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md +++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Bhavin Patel, Splunk - **ID**: 27c3a83d-cada-47c6-9042-67baf19d2574 diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md index c859bd9d1e..7a0384440c 100644 --- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md +++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 4057291a-b8cf-11eb-95fe-acde48001122 diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md index bce22418d1..ff453ed1e9 100644 --- a/docs/_posts/2021-09-16-detect_renamed_psexec.md +++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 683e6196-b8e8-11eb-9a79-acde48001122 diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md index c8406e1ff7..c5eec05b17 100644 --- a/docs/_posts/2021-09-16-detect_renamed_rclone.md +++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 6dca1124-b3ec-11eb-9328-acde48001122 diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md index 67cfb47e7a..cc818d4d12 100644 --- a/docs/_posts/2021-09-16-detect_renamed_winrar.md +++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md index 2c2ccf112e..290b26c167 100644 --- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md +++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: 3742ebfe-64c2-11eb-ae93-0242ac130002 diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md index 21e4194af0..215aeaf797 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 5d0d4830-0133-11ec-bae3-acde48001122 @@ -56,8 +57,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `local_account_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md index 24136fba0a..569b8dba8c 100644 --- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md +++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 4902d7aa-0134-11ec-9d65-acde48001122 diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md index faaa281b3e..af12772d54 100644 --- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md +++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following detection identifies the latest behavior utilized by Ursnif malwar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Splunk - **ID**: ffc236d6-a6c9-11eb-95f1-acde48001122 diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md index fcf1433702..8b4469301f 100644 --- a/docs/_posts/2021-09-16-processes_launching_netsh.md +++ b/docs/_posts/2021-09-16-processes_launching_netsh.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-16 - **Author**: Michael Haag, Josef Kuepker, Splunk - **ID**: b89919ed-fe5f-492c-b139-95dbb162040e diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md index 184a3fa66f..7ee6b47c4f 100644 --- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md +++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect potential malicious office document executing lolbin ch - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md index 3dc864feb2..f225220998 100644 --- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md +++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-20 - **Author**: Michael Haag, Splunk - **ID**: f0db4464-55d9-11eb-ae93-0242ac130002 @@ -61,9 +62,9 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi #### Macros The SPL above uses the following Macros: +* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml) Note that `suspicious_microsoft_workflow_compiler_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -92,6 +93,7 @@ Although unlikely, some legitimate applications may use a moved copy of microsof * [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution) * [Cobalt Strike](/stories/cobalt_strike) * [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md index b2522ba26a..7f4a00ec73 100644 --- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md +++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect file creation in remcos folder in appdata which is the - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 25ae862a-1ac3-11ec-94a1-acde48001122 diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md index 22714bc6b8..0c6ae8cd81 100644 --- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a suspicious creation of image in appdata folder made b - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: f6f904c4-1ac0-11ec-806b-acde48001122 diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md index c4f27b48d1..d3fca2e240 100644 --- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md +++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to detect a suspicious creation of .wav file in appdata folder. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 5be109e6-1ac5-11ec-b421-acde48001122 diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md index 7eaca931dd..7eeccc4f08 100644 --- a/docs/_posts/2021-09-27-change_default_file_association.md +++ b/docs/_posts/2021-09-27-change_default_file_association.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is developed to detect suspicious registry modification to change - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 462d17d8-1f71-11ec-ad07-acde48001122 diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md index cc7cc3e986..a09415322d 100644 --- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a suspicious modification of registry entry to persist - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 4c38c264-1f74-11ec-b5fa-acde48001122 diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md index 43ec6ebfa3..453c63c8ee 100644 --- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md +++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is developed to detect possible event trigger execution through sc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-09-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 58cea3ec-1f6d-11ec-8560-acde48001122 diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md index 2028b23b99..fca646fc11 100644 --- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md +++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md @@ -25,7 +25,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic is to detect a suspicious modification or new registry entry regar - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 1f5b68aa-2037-11ec-898e-acde48001122 diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md index 6c8a39708e..8dc50727dc 100644 --- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md +++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-09-29 - **Author**: Teoderick Contreras, Splunk - **ID**: 61e9a56a-20fa-11ec-8ba3-acde48001122 diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md index 263607a67d..2e26b51d1b 100644 --- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md +++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-01 - **Author**: Teoderick Contreras, Splunk - **ID**: 35159940-228f-11ec-8a49-acde48001122 diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md index 2cfbbc59d2..1df4c79565 100644 --- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md +++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 213b3148-24ea-11ec-93a2-acde48001122 @@ -56,9 +57,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind #### Macros The SPL above uses the following Macros: +* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml) Note that `msbuild_suspicious_spawned_by_script_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md index 0f56604873..e462bf4e56 100644 --- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md +++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a loading of dll using regsvr32 application with sile - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-04 - **Author**: Teoderick Contreras, Splunk - **ID**: f421c250-24e7-11ec-bc43-acde48001122 @@ -89,6 +90,7 @@ Other third part application may used this parameter but not so common in base w * [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity) * [Remcos](/stories/remcos) * [Hermetic Wiper](/stories/hermetic_wiper) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md index c7a1a636df..b1f7ad1ef1 100644 --- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md +++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ The following query identifies suspicious .aspx created in 3 paths identified by - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Shannon Davis, David Dorsey, Splunk - **ID**: 8c14eeee-2af1-4a4b-bda8-228da0f4862a diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md index 651a912f66..d66f2e7caa 100644 --- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md +++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies a process modifying the registry with a known - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: 127c8d08-25ff-11ec-9223-acde48001122 diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md index 8e27a34dbf..ef4e8f1ee3 100644 --- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md +++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: b0a078e4-2601-11ec-9aec-acde48001122 diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md index 2f23c082e4..31104ce5a3 100644 --- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md +++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Teoderick Contreras, Splunk - **ID**: a913718a-25b6-11ec-96d3-acde48001122 @@ -51,9 +52,9 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `rundll32_shimcache_flush_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -80,6 +81,7 @@ unknown #### Associated Analytic story * [Unusual Processes](/stories/unusual_processes) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md index c22f2ee7ae..a02f7dd360 100644 --- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md +++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Teoderick Contreras, Splunk - **ID**: ce633e56-25b2-11ec-9e76-acde48001122 @@ -56,9 +57,9 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t #### Macros The SPL above uses the following Macros: +* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml) Note that `suspicious_copy_on_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md index 3543a70b29..7b44650cf8 100644 --- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md +++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-05 - **Author**: Michael Haag, Splunk - **ID**: d17dae9e-2618-11ec-b9f5-acde48001122 diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md index 482634ce29..cbb1421c47 100644 --- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md +++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search allows you to identify DNS requests and compute the standard deviati - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Bhavin Patel, Splunk - **ID**: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md index 4c117a3b6e..41ad6f2f06 100644 --- a/docs/_posts/2021-10-06-sdelete_application_execution.md +++ b/docs/_posts/2021-10-06-sdelete_application_execution.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ This analytic is to detect the execution of sdelete.exe application sysinternal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 31702fc0-2682-11ec-85c3-acde48001122 @@ -61,9 +62,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `sdelete_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md index ad21ebcd27..4ee26e1dcd 100644 --- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md +++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md @@ -31,7 +31,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -40,6 +40,7 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-06 - **Author**: Teoderick Contreras, Splunk - **ID**: 1f35e1da-267b-11ec-90a9-acde48001122 diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md index c9e3f22772..759014c7e0 100644 --- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md +++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The wevtutil.exe application is the windows event log utility. This searches for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-11 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md index eac35a7612..c73e9be38a 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,7 +29,8 @@ During triage, review parallel processes for further suspicious activity. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-10-14 - **Author**: Michael Haag, Splunk - **ID**: 13243068-2d38-11ec-8908-acde48001122 @@ -53,8 +54,8 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `serviceprincipalnames_discovery_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md index 52cac29b80..3605a97c4b 100644 --- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md +++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ During triage, review parallel processes for further suspicious activity. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-14 - **Author**: Michael Haag, Splunk - **ID**: ae8b3efc-2d2e-11ec-8b57-acde48001122 @@ -58,9 +59,9 @@ During triage, review parallel processes for further suspicious activity. #### Macros The SPL above uses the following Macros: +* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml) Note that `serviceprincipalnames_discovery_with_setspn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md index 1371e8a55a..8e24e1c464 100644 --- a/docs/_posts/2021-10-18-disable_schedule_task.md +++ b/docs/_posts/2021-10-18-disable_schedule_task.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious commandline to disable existing schedule - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-18 - **Author**: Teoderick Contreras, Splunk - **ID**: db596056-3019-11ec-a9ff-acde48001122 @@ -77,6 +78,7 @@ admin may disable problematic schedule task #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md index f9b1ae67f3..c2a72b11ed 100644 --- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md +++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ During triage, review parallel processes for further behavior. In addition, iden - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-10-19 - **Author**: Michael Haag, Splunk - **ID**: c32f091e-30db-11ec-8738-acde48001122 diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md index 6e9f60f037..1415bd814e 100644 --- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md +++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ The following hunting analytic assists with identifying suspicious tasks that ha - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-10-19 - **Author**: Michael Haag, Splunk - **ID**: b3632472-310b-11ec-9aab-acde48001122 @@ -53,8 +54,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `winevent_windows_task_scheduler_event_action_started_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md index ca763e176a..e26bb74d62 100644 --- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md +++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-10-20 - **Author**: Teoderick Contreras, Splunk - **ID**: bff0e7a0-317f-11ec-ab4e-acde48001122 diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md index a16619aec7..94f4514948 100644 --- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md +++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search can help the detection of compromised accounts or internal users sha - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-10-24 - **Author**: Rod Soto, Teoderick Contreras - **ID**: a7131dae-34e3-11ec-a2de-acde48001122 diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md index 8bcf42bcf7..62a16b9f29 100644 --- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md +++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md @@ -19,7 +19,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search can help the detection of compromised accounts or internal users sen - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-10-24 - **Author**: Rod Soto, Teoderick Contreras - **ID**: 03cdd68a-34fb-11ec-9bd3-acde48001122 diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md index d883a6f84f..2172d48449 100644 --- a/docs/_posts/2021-11-03-windows_adfind_exe.md +++ b/docs/_posts/2021-11-03-windows_adfind_exe.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search looks for the execution of `adfind.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-03 - **Author**: Jose Hernandez, Bhavin Patel, Splunk - **ID**: bd3b0187-189b-46c0-be45-f52da2bae67f diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md index 6c10823c9b..94a49b9412 100644 --- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md +++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ This search looks for execution of commonly used attacker tools on an endpoint. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-04 - **Author**: Bhavin Patel, Splunk - **ID**: a51bfe1a-94f0-48cc-b4e4-16a110145893 diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md index 70c8a671a8..3fd652b65b 100644 --- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md +++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ Adversaries may use one of the three methods based on the remote destination and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Michael Haag, Splunk - **ID**: 42f8f1a2-4228-11ec-aade-acde48001122 diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md index 4fa58c0131..fcd2e80acb 100644 --- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Mauricio Velazco, Splunk - **ID**: e0eea4fa-4274-11ec-882b-3e22fbd008af diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md index 3d7b3fdf54..b9aa422bfd 100644 --- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-10 - **Author**: Mauricio Velazco, Splunk - **ID**: 3f519894-4276-11ec-ab02-3e22fbd008af diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md index 8ca18fc560..f19a90005b 100644 --- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md +++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 0dd296a2-4338-11ec-ba02-3e22fbd008af diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md index d7bef8fbae..a9a25d464a 100644 --- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md +++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 4be54858-432f-11ec-8209-3e22fbd008af @@ -88,6 +89,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md index 4ac12cc318..8addb2be9b 100644 --- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md +++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Mauricio Velazco, Splunk - **ID**: 95cf4608-4302-11ec-8194-3e22fbd008af @@ -88,6 +89,7 @@ Administrators may start scheduled tasks on remote systems, but this activity is #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md index 6dd3131eb9..8646bf2cf5 100644 --- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md +++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: David Dorsey, Mauricio Velazco, Splunk - **ID**: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 @@ -83,6 +84,7 @@ Administrators may create scheduled tasks on remote systems, but this activity i #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) * [NOBELIUM Group](/stories/nobelium_group) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md index 46b83eb4f0..38aade2146 100644 --- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md +++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-11 - **Author**: Michael Haag, Splunk - **ID**: 787e9dd0-4328-11ec-a029-acde48001122 diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md index cfbf00c3b9..bcd30c1417 100644 --- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md +++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following detection identifies excessive AccessDenied events within an hour - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: 3e1f1568-9633-11eb-a69c-acde48001122 diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md index 6db8348ced..2b8c2e1843 100644 --- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md +++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this analytic is to detect a suspicious compile before delivery approach of .net - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: ea73128a-43ab-11ec-9753-acde48001122 diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md index b51fa19611..d3c3996330 100644 --- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md +++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a potential suspicious modification of firewall rule allow - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 9a8f63a8-43ac-11ec-904c-acde48001122 diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md index 5e07bef98f..17678de486 100644 --- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md +++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic look for a spawned process of route.exe windows application. Adver - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: dd83407e-439f-11ec-ab8e-acde48001122 diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md index 76a31d818a..10b4a986ee 100644 --- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md +++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Rico Valdez, Mauricio Velazco, Splunk - **ID**: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md index d6c2d68952..02ff558b5a 100644 --- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md +++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic look for a spawned runas.exe process with a administrator user opt - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-12 - **Author**: Teoderick Contreras, Splunk - **ID**: 4807e716-43a4-11ec-a0e7-acde48001122 @@ -58,9 +59,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt #### Macros The SPL above uses the following Macros: -* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml) Note that `runas_execution_in_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md index 23c0075850..667e369fa6 100644 --- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md +++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: ccfeddec-43ec-11ec-b494-acde48001122 diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md index 73557c6025..3845642efb 100644 --- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md +++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: cfa7b9ac-43f0-11ec-9b48-acde48001122 @@ -60,9 +61,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) Note that `windows_installutil_uninstall_option_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -89,6 +90,7 @@ Limited false positives should be present. Filter as needed by parent process or #### Associated Analytic story * [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md index eeb1606617..4772be895d 100644 --- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md +++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ During triage review resulting network connections, file modifications, and para - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-12 - **Author**: Michael Haag, Splunk - **ID**: 28e06670-43df-11ec-a569-acde48001122 @@ -59,9 +60,9 @@ During triage review resulting network connections, file modifications, and para #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) Note that `windows_installutil_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -88,6 +89,7 @@ Limited false positives should be present as InstallUtil is not typically used t #### Associated Analytic story * [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md index 136a1cf468..1f1c6d98be 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: d4f42098-4680-11ec-ad07-3e22fbd008af @@ -56,9 +57,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `remote_process_instantiation_via_dcom_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md index 189935811e..1eb0f5ee93 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: fa1c3040-4680-11ec-a618-3e22fbd008af @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `remote_process_instantiation_via_dcom_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md index 87587695c1..7ba39af60f 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 112638b4-4634-11ec-b9ab-3e22fbd008af @@ -51,9 +52,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `remote_process_instantiation_via_wmi_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md index 25985471b8..b115415e12 100644 --- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md +++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-15 - **Author**: Mauricio Velazco, Splunk - **ID**: 2a048c14-4634-11ec-a618-3e22fbd008af @@ -48,8 +49,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `remote_process_instantiation_via_wmi_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md index 1703734b77..5b810dfe94 100644 --- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md +++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-15 - **Author**: Michael Haag, Splunk - **ID**: d56fe0c8-4650-11ec-a8fa-acde48001122 diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md index 502e9da7c9..a4d70d4fe9 100644 --- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md +++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to detect a suspicious high frequency copying/moving of files i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-16 - **Author**: Teoderick Contreras, Splunk - **ID**: 40925f12-4709-11ec-bb43-acde48001122 diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md index 0d061adcc3..2de290c663 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-16 - **Author**: Mauricio Velazco, Splunk - **ID**: ba24cda8-4716-11ec-8009-3e22fbd008af @@ -56,9 +57,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `remote_process_instantiation_via_winrm_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md index 30a4fe566e..746e5bb8fc 100644 --- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md +++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-16 - **Author**: Mauricio Velazco, Splunk - **ID**: 7d4c618e-4716-11ec-951c-3e22fbd008af @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `remote_process_instantiation_via_winrm_and_powershell_script_block_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md index 89cd8252fe..84d432e2c4 100644 --- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md +++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-17 - **Author**: Michael Haag, Splunk - **ID**: 8567da9e-47f0-11ec-99a9-acde48001122 diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md index 3e0604382e..55963a1110 100644 --- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md +++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies executable files (.exe or .dll) being written - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-18 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: f63c34fe-a435-11eb-935a-acde48001122 @@ -54,8 +55,8 @@ The following analytic identifies executable files (.exe or .dll) being written #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `executable_file_written_in_administrative_smb_share_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md index 5bb2c2edcb..1412062c6b 100644 --- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md +++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-18 - **Author**: Teoderick Contreras, Splunk - **ID**: eac5e8ba-4857-11ec-9371-acde48001122 diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md index ea81567e06..0527982289 100644 --- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md +++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-19 - **Author**: Teoderick Contreras, Splunk - **ID**: f92d74f2-4921-11ec-b685-acde48001122 @@ -51,9 +52,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio #### Macros The SPL above uses the following Macros: +* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml) Note that `system_info_gathering_using_dxdiag_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md index 14b88a2ec2..6b503e9ada 100644 --- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md +++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will detect if a suspicious process contains a commandline paramet - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ba484e8-4b97-11ec-b19a-acde48001122 diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md index 85ccb07cbd..3798452bc4 100644 --- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: ba9e1954-4c04-11ec-8b74-3e22fbd008af @@ -86,6 +87,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md index 8ed1ae7ab9..8ba87bdb66 100644 --- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af @@ -88,6 +89,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md index a62d6f41e7..25a02762d9 100644 --- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-22 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 429141be-8311-11eb-adb6-acde48001122 diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md index 7361eb6b49..e1d1f7b305 100644 --- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md +++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 3abb2eda-4bb8-11ec-9ae4-3e22fbd008af diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md index 79cbb2a83d..bee9fe8ccf 100644 --- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 95a455f0-4c04-11ec-b8ac-3e22fbd008af diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md index 0296d98e72..bdc2b8d64c 100644 --- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 2eed004c-4c0d-11ec-93e8-3e22fbd008af diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md index 99e1b3239e..29ef270dc9 100644 --- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md +++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-23 - **Author**: Mauricio Velazco, Splunk - **ID**: f6601940-4c74-11ec-b9b7-3e22fbd008af @@ -84,6 +85,7 @@ Legitimate applications may trigger this behavior, filter as needed. #### Associated Analytic story * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md index 420e7a1a5a..fe19ee8876 100644 --- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md +++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will identify a suspicious process command-line related to Windows - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 773b66fe-4dd9-11ec-8289-acde48001122 diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md index d13646b452..63adaf385f 100644 --- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md +++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will detect a suspicious process commandline related to windows de - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 907ac95c-4dd9-11ec-ba2c-acde48001122 @@ -55,8 +56,8 @@ This analytic will detect a suspicious process commandline related to windows de #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_windows_defender_exclusion_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md index 41825f68ce..202de298dd 100644 --- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md +++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will detect a suspicious process that modify a registry related to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-25 - **Author**: Teoderick Contreras, Splunk - **ID**: 13395a44-4dd9-11ec-9df7-acde48001122 diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md index cd15d09ca3..607fa4ec17 100644 --- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md +++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-29 - **Author**: Michael Haag, Splunk - **ID**: 32e0baea-b3f1-11eb-a2ce-acde48001122 diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md index 42ad2c1b79..6143761d87 100644 --- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md +++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md @@ -39,7 +39,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -48,6 +48,7 @@ The following analytic assists with identifying a PowerShell process spawned as - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: cb909b3e-512b-11ec-aa31-3e22fbd008af diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md index 194fefef72..4af01152ad 100644 --- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md @@ -26,7 +26,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,7 +34,8 @@ The following hunting analytic leverages Event ID 4698, `A scheduled task was cr - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: 9d22a780-5165-11ec-ad4f-3e22fbd008af diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md index 9288f67aab..fcf95ad060 100644 --- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md +++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md @@ -24,7 +24,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,7 +32,8 @@ The following hunting analytic leverages Event ID 7045, `A new service was insta - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-11-29 - **Author**: Mauricio Velazco, Splunk - **ID**: 2032a95a-5165-11ec-a2c3-3e22fbd008af diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md index 5d738c176b..2e3b47ea0f 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md +++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-12-01 - **Author**: Mauricio Velazco, Splunk - **ID**: ac3b81c0-52f4-11ec-ac44-acde48001122 diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md index 5406d67164..af522dcfe5 100644 --- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md +++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md @@ -22,7 +22,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,7 +31,8 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-12-01 - **Author**: Mauricio Velazco, Splunk - **ID**: acb5dc74-5324-11ec-a36d-acde48001122 diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md index bbdd17df09..2e9be2c098 100644 --- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md +++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ The following analytic leverages Windows Security EventCode 4698, `A scheduled t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-12-03 - **Author**: Mauricio Velazco, Splunk - **ID**: 6fa31414-546e-11ec-adfa-acde48001122 diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md index af5de4202a..2d995f3691 100644 --- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md +++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The search logic specifically looks for high number of distinct commands run in - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-06 - **Author**: Bhavin Patel, Splunk - **ID**: 0edd5112-56c9-11ec-b990-acde48001122 diff --git a/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md new file mode 100644 index 0000000000..bd6e8908b1 --- /dev/null +++ b/docs/_posts/2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md @@ -0,0 +1,129 @@ +--- +title: "MS Exchange Mailbox Replication service writing Active Server Pages" +excerpt: "Server Software Component +, Web Shell +, Exploit Public-Facing Application +" +categories: + - Endpoint +last_modified_at: 2021-12-07 +toc: true +toc_label: "" +tags: + - Server Software Component + - Web Shell + - Exploit Public-Facing Application + - Persistence + - Persistence + - Initial Access + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + +### WARNING THIS IS A EXPERIMENTAL object +We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2021-12-07 +- **Author**: Michael Haag, Splunk +- **ID**: 985f322c-57a5-11ec-b9ac-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence | + +| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence | + +| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest +| `drop_dm_object_name(Processes)` +| join process_guid, _time [ +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path +| `drop_dm_object_name(Filesystem)` +| fields _time dest file_create_time file_name file_path process_name process_path process process_guid] +| dedup file_create_time +| table dest file_create_time, file_name, file_path, process_name +| `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Filesystem.file_path +* Filesystem.process_id +* Filesystem.file_name +* Filesystem.file_hash +* Filesystem.user +* Filesystem.process_guid +* Processes.process_name +* Processes.process_id +* Processes.process_name +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. + +#### Known False Positives +The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. + +#### Associated Analytic story +* [ProxyShell](/stories/proxyshell) +* [Ransomware](/stories/ransomware) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 81.0 | 90 | 90 | A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$. | + + + + +#### Reference + +* [https://redcanary.com/blog/blackbyte-ransomware/](https://redcanary.com/blog/blackbyte-ransomware/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md index f07825d9f7..5078e0885f 100644 --- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md +++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies the Raccine Rules Updater scheduled task being - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2021-12-07 - **Author**: Michael Haag, Splunk - **ID**: c9f010da-57ab-11ec-82bd-acde48001122 diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md index 0a941d18fc..a154d93732 100644 --- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md +++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,7 +38,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-12-08 - **Author**: Michael Haag, Splunk - **ID**: ccb98a66-5851-11ec-b91c-acde48001122 diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md index e1b80adfe3..380285d4db 100644 --- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md +++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-10 - **Author**: Michael Haag, Splunk - **ID**: 900bc324-59f3-11ec-9fb4-acde48001122 diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md index 1998432f2b..6edd380484 100644 --- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md +++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-11 - **Author**: Michael Haag, Splunk - **ID**: 35682718-5a85-11ec-b8f7-acde48001122 diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md index 2993b5c20c..2b06e6fc97 100644 --- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md +++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ Malicious actors often abuse misconfigured LDAP servers or applications that use - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic) + - **Last Updated**: 2021-12-13 - **Author**: Bhavin Patel, Johan Bjerke, Splunk - **ID**: 5e06e262-d7cd-4216-b2f8-27b437e18458 diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md index 9b905f2e52..7c7638d37b 100644 --- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md +++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies a Java user agent performing a GET request for - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 8281ce42-5c50-11ec-82d2-acde48001122 diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md index b19cbf0f6d..4f831677d0 100644 --- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md +++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 7b09db8a-5c20-11ec-9945-acde48001122 @@ -53,8 +54,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp #### Macros The SPL above uses the following Macros: * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) -* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml) Note that `linux_java_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md index 617b972034..981c5402a7 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2021-12-13 - **Author**: Jose Hernandez - **ID**: c184f12e-5c90-11ec-bf1f-497c9a704a72 diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md index f96ac8c352..926d2be5e8 100644 --- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md +++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic), [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2021-12-13 - **Author**: Jose Hernandez - **ID**: 69afee44-5c91-11ec-bf1f-497c9a704a72 diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md index 93809e893f..64f9524f73 100644 --- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md +++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -26,7 +26,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2021-12-13 - **Author**: Mauricio Velazco, Splunk - **ID**: d2c14d28-5c47-11ec-9892-acde48001122 diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md index 7236266732..1dc3c805b0 100644 --- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md +++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md @@ -21,7 +21,7 @@ tags: We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported. -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-13 - **Author**: Michael Haag, Splunk - **ID**: 28c81306-5c47-11ec-bfea-acde48001122 @@ -54,9 +55,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw #### Macros The SPL above uses the following Macros: +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) Note that `windows_java_spawning_shells_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md index 6aa9e731a0..6eea555649 100644 --- a/docs/_posts/2021-12-14-hunting_for_log4shell.md +++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web) + - **Last Updated**: 2021-12-14 - **Author**: Michael Haag, Splunk - **ID**: 158b68fa-5d1a-11ec-aac8-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md index ad8f211aea..11104a06e3 100644 --- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md +++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies a suspicious file creation in known cron table - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 023f3452-5f27-11ec-bf00-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md index ebd2ca92ac..97bba054e3 100644 --- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md +++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 977b3082-5f3d-11ec-b954-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md index d9e36be43f..2fdbee4543 100644 --- a/docs/_posts/2021-12-17-linux_at_application_execution.md +++ b/docs/_posts/2021-12-17-linux_at_application_execution.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies a suspicious process creation of At applicatio - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: bf0a378e-5f3c-11ec-a6de-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md index 2bad80676d..2f77a91aae 100644 --- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md +++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies a suspicious cronjobs modification using cront - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 0d370304-5f26-11ec-a4bb-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md index 0d2e419e74..3138b11829 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for suspicious commandline that may use to append user entry - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 7bc20606-5f40-11ec-a586-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md index f900bb72e8..8be54e459e 100644 --- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md +++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for possible suspicious commandline that may use to append a - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: b5b91200-5f27-11ec-bb4e-acde48001122 diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md index cfd1575273..e9f30e54ff 100644 --- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md +++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for possible modification of cronjobs file using editor. Thi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-17 - **Author**: Teoderick Contreras, Splunk - **ID**: dcc89bde-5f24-11ec-87ca-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md index 6c8af424a4..50568f876e 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious file creation on init system directories for - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 97d9cfb2-61ad-11ec-bb2d-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md index b3d9bb2062..e31030e3e6 100644 --- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md +++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 46ba0082-61af-11ec-9826-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md index 7c14cd1ed7..cc4e5c784e 100644 --- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md +++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious command-lines that can be possibly used to mo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c94732a-61af-11ec-91e3-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md index c87840d06c..f11c7e8c67 100644 --- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md +++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for suspicious file creation in systemd timer directory in l - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: c7495048-61b6-11ec-9a37-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md index 1fde9706e5..eee0bc61fc 100644 --- a/docs/_posts/2021-12-20-linux_service_restarted.md +++ b/docs/_posts/2021-12-20-linux_service_restarted.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for restarted or re-enable services in linux platform. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: 084275ba-61b8-11ec-8d64-acde48001122 diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md index bf4b45d39b..88118dec91 100644 --- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md +++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic looks for created or enable services in linux platform. This techn - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Teoderick Contreras, Splunk - **ID**: e0428212-61b7-11ec-88a3-acde48001122 diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md index c11254d72e..c92d8bd1f7 100644 --- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md +++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md @@ -29,7 +29,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Mauricio Velazco, Splunk - **ID**: 35a61ed8-61c4-11ec-bc1e-acde48001122 diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md index 93542c1e83..9c035ec9ad 100644 --- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md +++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md @@ -29,7 +29,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -38,6 +38,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-20 - **Author**: Mauricio Velazco, Splunk - **ID**: 8b1297bc-6204-11ec-b7c4-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md index 81c4740217..d83ff36bf1 100644 --- a/docs/_posts/2021-12-21-linux_add_user_account.md +++ b/docs/_posts/2021-12-21-linux_add_user_account.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for commands to create user accounts on the linux platform. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 51fbcaf2-6259-11ec-b0f3-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md index 28a5bbb742..7b1c8e08de 100644 --- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md +++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic looks for a commandline that change the file owner to root using c - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: c1400ea2-6257-11ec-ad49-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md index 91c27c527b..df7ee8affc 100644 --- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md +++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to look for suspicious command lines that may add entry to /etc - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: ab1e0d52-624a-11ec-8e0b-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md index 95eef95944..fdacc24010 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: bf0304b6-6250-11ec-9d7c-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md index 3ce6d36067..5a61e301f7 100644 --- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md +++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 9d96022e-6250-11ec-9a19-acde48001122 diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md index 59569a2f1e..5651a83a54 100644 --- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md +++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Teoderick Contreras, Splunk - **ID**: 08c41040-624c-11ec-a71f-acde48001122 diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md index 1d72427c29..5d4a496b5b 100644 --- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md +++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Im - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-21 - **Author**: Mauricio Velazco, Splunk - **ID**: d77d349e-6269-11ec-9cfe-acde48001122 diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md index a10ad6ee62..ac0ce8567a 100644 --- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md +++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for suspicious file creation in kernel/driver directory in l - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: b85bbeec-6326-11ec-9311-acde48001122 diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md index 578fedb286..b8b9fe327f 100644 --- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md +++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for inserting of linux kernel module using insmod utility fu - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 18b5a1a0-6326-11ec-943a-acde48001122 diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md index 26f82a442e..077b070e62 100644 --- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md +++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic looks for possible installing a linux kernel module using modprobe - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 387b278a-6326-11ec-aa2c-acde48001122 diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md index c76976f60e..9ead51a7a9 100644 --- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md +++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ This analytic is to detect a suspicious command that may hijack a library functi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-22 - **Author**: Teoderick Contreras, Splunk - **ID**: cbe2ca30-631e-11ec-8670-acde48001122 diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md index 6e6d0368a9..45c8046cc6 100644 --- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md +++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to look for possible elevation control access using a common kn - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 66ab15c0-63d0-11ec-9e70-acde48001122 diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md index 1e358db4dd..b777df2f57 100644 --- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md +++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2021-12-23 - **Author**: Teoderick Contreras, Splunk - **ID**: be254a5c-63e7-11ec-89da-acde48001122 diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md index f62328b01d..fb99121ecd 100644 --- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md +++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect the execution of sudo or su command in linux operatin - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-04 - **Author**: Teoderick Contreras, Splunk - **ID**: 4b00f134-6d6a-11ec-a90c-acde48001122 diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md index c507789e55..4bd04da89e 100644 --- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md +++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect the creation of doas.conf file in linux host platform - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-05 - **Author**: Teoderick Contreras, Splunk - **ID**: f6343e86-6e09-11ec-9376-acde48001122 diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md index 0e4ef149da..c308cf5768 100644 --- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md +++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect the doas tool execution in linux host platform. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-05 - **Author**: Teoderick Contreras, Splunk - **ID**: d5a62490-6e09-11ec-884e-acde48001122 diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md index ea1836cb40..b7a5e56af4 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a possible attempt to dump or access the content of / - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 16107e0e-71fc-11ec-b862-acde48001122 diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md index ceb6e000f5..a3d718e1cd 100644 --- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md +++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-10 - **Author**: Teoderick Contreras, Splunk - **ID**: 4479539c-71fc-11ec-b2e2-acde48001122 diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md index 2b2f847db4..41b74f6697 100644 --- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md +++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to look for suspicious process command-line that might be acces - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 7a85eb24-72da-11ec-ac76-acde48001122 diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md index cf6db26ecc..0f9d915cb7 100644 --- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md +++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-11 - **Author**: Teoderick Contreras, Splunk - **ID**: c04ef40c-72da-11ec-8eac-acde48001122 diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md index 3aec6c5276..bb0fa0fcaa 100644 --- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md +++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-12 - **Author**: David Dorsey, Michael Haag Splunk - **ID**: ee18ed37-0802-4268-9435-b3b91aaa18db @@ -62,9 +63,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `powershell_-_connect_to_internet_with_hidden_window_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md index 61cc588560..66943892c9 100644 --- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following hunting analytic identifies all processes requesting access into L - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-01-12 - **Author**: Michael Haag, Splunk - **ID**: 1c6abb08-73d1-11ec-9ca0-acde48001122 diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md index 7210e6df16..4aa188380b 100644 --- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md +++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-01-12 - **Author**: Michael Haag, Splunk - **ID**: b1ce9a72-73cf-11ec-981b-acde48001122 diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md index 8107aa3ab7..a9db929c55 100644 --- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md +++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic uses a pretrained machine learning text classifier to det - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-14 - **Author**: Michael Hart, Splunk - **ID**: 9c53c446-757e-11ec-871d-acde48001122 @@ -57,9 +58,9 @@ The following analytic uses a pretrained machine learning text classifier to det #### Macros The SPL above uses the following Macros: +* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml) Note that `potentially_malicious_code_on_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md index 66b65f39b6..d7185453b0 100644 --- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md +++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -31,6 +31,7 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Bhavin Patel, Splunk - **ID**: 54a6ed00-3256-11ec-b031-acde48001122 @@ -57,8 +58,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `cmd_carry_out_string_command_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -87,6 +88,7 @@ False positives may be high based on legitimate scripted code in any environment * [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228) * [WhisperGate](/stories/whispergate) * [Hermetic Wiper](/stories/hermetic_wiper) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md index aec9a1a50e..d1c5bac0e4 100644 --- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md +++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md @@ -31,7 +31,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -40,6 +40,7 @@ This analytic looks for the presence of suspicious commandline parameters typica - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-18 - **Author**: Mauricio Velazco, Splunk - **ID**: 8ce07472-496f-11ec-ab3b-3e22fbd008af diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md index 9ea69ab924..06be24d18f 100644 --- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md +++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-18 - **Author**: David Dorsey, Michael Haag, Splunk - **ID**: c4db14d9-7909-48b4-a054-aa14d89dbb19 @@ -59,9 +60,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov. #### Macros The SPL above uses the following Macros: -* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml) Note that `malicious_powershell_process_-_encoded_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md index 662cfc38e5..bc66a57c03 100644 --- a/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md +++ b/docs/_posts/2022-01-18-powershell_remove_windows_defender_directory.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will identify a suspicious PowerShell command used to delete the W - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Splunk - **ID**: adf47620-79fa-11ec-b248-acde48001122 @@ -55,8 +56,8 @@ This analytic will identify a suspicious PowerShell command used to delete the W #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `powershell_remove_windows_defender_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md index bb92a8b485..a632288cc0 100644 --- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md +++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a suspicious process making a DNS query via known, abused - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-18 - **Author**: Teoderick Contreras, Splunk - **ID**: 3cf0dc36-484d-11ec-a6bc-acde48001122 diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md index 0e18e9298c..15514a149f 100644 --- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md +++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic identifies a process making a DNS query to Discord, a well known i - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-19 - **Author**: Teoderick Contreras, Splunk - **ID**: 4d4332ae-792c-11ec-89c1-acde48001122 diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md index de857e588e..e8b0e3a9ab 100644 --- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following analytic identifies native .net binaries within the Windows operat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-19 - **Author**: Michael Haag, Splunk - **ID**: fddf3b56-7933-11ec-98a6-acde48001122 @@ -67,8 +68,8 @@ The following analytic identifies native .net binaries within the Windows operat #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) Note that `windows_dotnet_binary_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md index f67e988fea..ba08a69606 100644 --- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md +++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-19 - **Author**: Michael Haag, Splunk - **ID**: dcf74b22-7933-11ec-857c-acde48001122 @@ -66,9 +67,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro #### Macros The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) Note that `windows_installutil_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -99,6 +100,7 @@ False positives may be present and filtering may be required. Certain utilities * [Ransomware](/stories/ransomware) * [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) * [WhisperGate](/stories/whispergate) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md index 6d4f3a1ac4..7d39b30789 100644 --- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md +++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic will identify excessive file deletion events in the Windows Defend - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-20 - **Author**: Teoderick Contreras, Splunk - **ID**: b5baa09a-7a05-11ec-8da4-acde48001122 diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md index f410494080..389940e407 100644 --- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md +++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic will identify the possible execution of ping sleep batch commands. - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-20 - **Author**: Teoderick Contreras, Splunk - **ID**: ce058d6c-79f2-11ec-b476-acde48001122 diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md index 7578830a45..94b3af79b8 100644 --- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md +++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-21 - **Author**: Michael Haag, Splunk - **ID**: bb4f3090-7ae4-11ec-897f-acde48001122 diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md index 7e59e7ef04..6a4758ce32 100644 --- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md +++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following hunting analytic assists with identifying the proces execution of - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-24 - **Author**: Michael Haag, Splunk - **ID**: 5b2f4596-7d4c-11ec-88a7-acde48001122 diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md index 29bc51b67a..a40afd8a63 100644 --- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md +++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect a suspicious modification of the active setup registr - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: f64579c0-203f-11ec-abcc-acde48001122 diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md index bdd3dd1a71..2fce5334e2 100644 --- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md +++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to detect a suspicious registry modification to implement auto ad - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: d4a3eb62-0f1e-11ec-a971-acde48001122 diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md index f0880828e2..10678fd5fa 100644 --- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md +++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a potential suspicious modification of firewall rule regis - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 0a46537c-be02-11eb-92ca-acde48001122 diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md index 323fe8608c..6950ba1040 100644 --- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md +++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This analytic identifies a potential privilege escalation attempt to perform mal - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 7de17d7a-c9d8-11eb-a812-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md index 3803838b99..67b7fd7cc9 100644 --- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md +++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to identify modification in registry to disable AMSI windows feat - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c27ec42-d338-11eb-9044-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md index b72fb0df6d..e64de17828 100644 --- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: aa4f695a-3024-11ec-9987-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md index bf97ccdc3d..85c670fb1f 100644 --- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras - **ID**: 2dd719ac-3021-11ec-97b4-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md index bdcd4f074c..bb510920a1 100644 --- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md +++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: dc65678c-301f-11ec-8e30-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md index 13e153f6dc..f40c4dd508 100644 --- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md +++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: cc391750-3024-11ec-955a-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md index c3fd06f580..bb795d1d01 100644 --- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md +++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious modification of registry to disable wind - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 898debf4-3021-11ec-ba7c-acde48001122 diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md index fc01e39849..ee154c3d39 100644 --- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md +++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ his analytic is to detect a suspicious modification of registry to disable windo - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 73922ff8-3022-11ec-bf5e-acde48001122 diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md index e75581d04b..299ebcbad7 100644 --- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md +++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u - **Type**: [Correlation](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk) + - **Last Updated**: 2022-01-26 - **Author**: Jose Hernandez, Splunk - **ID**: 9be30d80-3a39-4df9-9102-64a467b24eac diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md index f26e69d23f..d00d29fab5 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The search looks for modifications to registry keys that can be used to launch a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md index 982ffd0dab..ba3ef8475c 100644 --- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md +++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ This search looks for modifications to registry keys that can be used to elevate - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-01-26 - **Author**: David Dorsey, Teoderick Contreras, Splunk - **ID**: c9f4b923-f8af-4155-b697-1354f5bcbc5e diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md index 9b48ba6478..4a8d905c1e 100644 --- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md +++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search detects registry key license at host where Remcos RAT agent is insta - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk - **ID**: f2a1615a-1d63-11ec-97d2-acde48001122 diff --git a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md index dcd990ae24..893352cca1 100644 --- a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md +++ b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect a modification or registry add to the safeboot registry - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: c6149154-c9d8-11eb-9da7-acde48001122 diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md index ab6e8d3665..b1d9955f2a 100644 --- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md +++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect a suspicious modification of time provider registry f - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-26 - **Author**: Teoderick Contreras, Splunk - **ID**: 5ba382c4-2105-11ec-8d8f-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md index a5aba1de55..c9b0820605 100644 --- a/docs/_posts/2022-01-27-disable_etw_through_registry.md +++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to identify modification in registry to disable ETW windows featu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: f0eacfa4-d33f-11eb-8f9d-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md index 925be726b2..8369371edc 100644 --- a/docs/_posts/2022-01-27-disable_registry_tool.md +++ b/docs/_posts/2022-01-27-disable_registry_tool.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search identifies modification of registry to disable the regedit or regist - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: cd2cf33c-9201-11eb-a10a-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md index 2b81c93906..5a9ff41c88 100644 --- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md +++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to detect a suspicious registry modification to disable securit - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 39ebdc68-25b9-11ec-aec7-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md index 56644d2b93..fa79066bdd 100644 --- a/docs/_posts/2022-01-27-disable_show_hidden_files.md +++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following analytic is to identify a modification in the Windows registry to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Mauricio Velazco, Splunk - **ID**: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md index 628dd18962..01d4809a05 100644 --- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md +++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 9928b732-210e-11ec-b65e-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md index 28965ebf82..559d78c74a 100644 --- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md +++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic detects a suspicious registry modification to disable Windows hotk - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 1490f224-ad8b-11eb-8c4f-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md index 42e42de255..d438343514 100644 --- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md +++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identifies a modification in registry to disable the windows d - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 79439cae-9200-11eb-a4d3-acde48001122 diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md index c5dc5b04b5..70809a2174 100644 --- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md +++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following search identifies a modification of registry to disable the smarts - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 664f0fd0-91ff-11eb-a56f-acde48001122 diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md index ba4034c9d3..22d321eb00 100644 --- a/docs/_posts/2022-01-27-disabling_cmd_application.md +++ b/docs/_posts/2022-01-27-disabling_cmd_application.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to identify modification in registry to disable cmd prompt applic - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: ff86077c-9212-11eb-a1e6-acde48001122 diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md index 8c03bb3591..b6ac48c0bd 100644 --- a/docs/_posts/2022-01-27-disabling_controlpanel.md +++ b/docs/_posts/2022-01-27-disabling_controlpanel.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ this search is to identify registry modification to disable control panel window - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-27 - **Author**: Teoderick Contreras, Splunk - **ID**: 6ae0148e-9215-11eb-a94a-acde48001122 diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md index d4b0fee0b1..a828ae2d4b 100644 --- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md +++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,7 +32,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-01-27 - **Author**: Michael Haag, Splunk - **ID**: e4723b92-7266-11ec-af45-acde48001122 diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md index 487cf9a2de..4fefc165ea 100644 --- a/docs/_posts/2022-01-28-disabling_defender_services.md +++ b/docs/_posts/2022-01-28-disabling_defender_services.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This particular behavior is typically executed when an adversaries or malware ga - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 911eacdc-317f-11ec-ad30-acde48001122 diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md index 2319a7f7c0..7726b1545f 100644 --- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md +++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identify registry modification to disable folder options featu - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 83776de4-921a-11eb-868a-acde48001122 diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md index d4ffb2a3c2..2f96520962 100644 --- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md +++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identify modification of registry to disable run application i - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: de81bc46-9213-11eb-adc9-acde48001122 diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md index 1023e38689..c9cefbf23b 100644 --- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md +++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following search identifies the modification of registry related in disablin - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: f4f837e2-91fb-11eb-8bf6-acde48001122 @@ -47,7 +48,7 @@ The following search identifies the modification of registry related in disablin ``` -| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableConfig" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [ diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md index 82d69bcd43..a7afa59992 100644 --- a/docs/_posts/2022-01-28-disabling_task_manager.md +++ b/docs/_posts/2022-01-28-disabling_task_manager.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to identifies modification of registry to disable the task manage - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: dac279bc-9202-11eb-b7fb-acde48001122 diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md index fe99b14c4c..0ca256659c 100644 --- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md +++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This search is to detect a modification to registry to enable rdp to a machine w - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 99495452-b899-11eb-96dc-acde48001122 diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md index 120c9c7bdf..18b300eb77 100644 --- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md +++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to detect a suspicious registry modification to enable plain te - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 0c7d8ffe-25b1-11ec-9f39-acde48001122 diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md index 28a760795f..9a4777a72c 100644 --- a/docs/_posts/2022-01-28-etw_registry_disabled.md +++ b/docs/_posts/2022-01-28-etw_registry_disabled.md @@ -24,7 +24,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -33,6 +33,7 @@ This analytic is to detect a registry modification to disable ETW feature of win - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 8ed523ac-276b-11ec-ac39-acde48001122 diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md index f3024aa07f..4fee0102ba 100644 --- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md +++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Michael Haag, Splunk - **ID**: 9cf8fe08-7ad8-11eb-9819-acde48001122 diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md index 62f068ac10..39034e92ca 100644 --- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md +++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic identifies a suspicious registry modification to hide a user accou - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-01-28 - **Author**: Teoderick Contreras, Splunk - **ID**: 834ba832-ad89-11eb-937d-acde48001122 diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md index f1f59ca68c..c8195a363c 100644 --- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md +++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies `pkexec` spawning with no command-line argumen - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-01-28 - **Author**: Michael Haag, Splunk - **ID**: 03e22c1c-8086-11ec-ac2e-acde48001122 diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md index 2d0ac76231..4b2506f5c8 100644 --- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md +++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ The following analytic looks for the use of Mimikatz command line parameters lev - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-01 - **Author**: Mauricio Velazco, Splunk - **ID**: 13bbd574-83ac-11ec-99d4-acde48001122 diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md index 88bd9a4455..0a6dfe12bb 100644 --- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md +++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md @@ -32,7 +32,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -41,6 +41,7 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-01 - **Author**: Mauricio Velazco, Splunk - **ID**: cca37478-8377-11ec-b59a-acde48001122 diff --git a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md index 27eef2e241..ce5dced718 100644 --- a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md +++ b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md @@ -27,7 +27,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -36,6 +36,7 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-01 - **Author**: Michael Haag, Splunk - **ID**: 7360137f-abad-473e-8189-acbdaa34d114 @@ -66,9 +67,9 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `suspicious_rundll32_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md index a45e5ba388..9716d7cc7f 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-03 - **Author**: Michael Haag, Splunk - **ID**: 415b4306-8bfb-11eb-85c4-acde48001122 @@ -81,6 +82,7 @@ Limited false positives in most environments, however tune as needed based on pa #### Associated Analytic story * [Ingress Tool Transfer](/stories/ingress_tool_transfer) * [DarkSide Ransomware](/stories/darkside_ransomware) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md index 0b114231af..e566e86602 100644 --- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md +++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-03 - **Author**: Michael Haag, Splunk - **ID**: 801ad9e4-8bfb-11eb-8b31-acde48001122 @@ -81,6 +82,7 @@ Limited false positives in most environments, however tune as needed based on pa #### Associated Analytic story * [Ingress Tool Transfer](/stories/ingress_tool_transfer) * [DarkSide Ransomware](/stories/darkside_ransomware) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-03-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md index 3a1ffca195..448fff5d16 100644 --- a/docs/_posts/2022-02-03-o365_added_service_principal.md +++ b/docs/_posts/2022-02-03-o365_added_service_principal.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects the creation of a new Federation setting by alerting about a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-03 - **Author**: Rod Soto, Splunk - **ID**: 1668812a-6047-11eb-ae93-0242ac130002 @@ -54,8 +55,8 @@ This search detects the creation of a new Federation setting by alerting about a #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_added_service_principal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md index 34928d21aa..7fb659f022 100644 --- a/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md +++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-03 - **Author**: Bhavin Patel, Splunk - **ID**: c783dd98-c703-4252-9e8a-f19d9f66949e @@ -59,8 +60,8 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_bypass_mfa_via_trusted_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md index 693d7741d6..a24615fc8b 100644 --- a/docs/_posts/2022-02-03-o365_disable_mfa.md +++ b/docs/_posts/2022-02-03-o365_disable_mfa.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,7 +27,8 @@ This search detects when multi factor authentication has been disabled, what ent - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-03 - **Author**: Rod Soto, Splunk - **ID**: c783dd98-c703-4252-9e8a-f19d9f5c949e @@ -51,8 +52,8 @@ This search detects when multi factor authentication has been disabled, what ent #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_disable_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md index cf132e05e2..2fa220e7d6 100644 --- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md +++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md @@ -22,7 +22,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,7 +30,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-07 - **Author**: Mauricio Velazco, Splunk - **ID**: 5ed8c50a-8869-11ec-876f-acde48001122 diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md index c182d92f37..41667fc862 100644 --- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md +++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-07 - **Author**: Michael Haag, Splunk - **ID**: ced50492-8849-11ec-9f68-acde48001122 @@ -52,9 +53,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e #### Macros The SPL above uses the following Macros: +* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml) Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md index 209dcf2256..51a9fffab9 100644 --- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md +++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies Schtasks.exe creating a new task to start and - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-07 - **Author**: Michael Haag, Splunk - **ID**: 41a0e58e-884c-11ec-9976-acde48001122 @@ -60,9 +61,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and #### Macros The SPL above uses the following Macros: +* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml) Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md index e241fd09bf..b34493f640 100644 --- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md +++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ The following analytic identifies rundll32.exe loading an export function by ord - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-08 - **Author**: Michael Haag, David Dorsey, Splunk - **ID**: 6c135f8d-5e60-454e-80b7-c56eed739833 @@ -57,9 +58,9 @@ The following analytic identifies rundll32.exe loading an export function by ord #### Macros The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. @@ -87,6 +88,7 @@ False positives are possible with native utilities and third party applications. #### Associated Analytic story * [Unusual Processes](/stories/unusual_processes) * [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md index b312237ea3..16477d31a0 100644 --- a/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md +++ b/docs/_posts/2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,7 +29,8 @@ The detection calculates the standard deviation for each host and leverages the - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-08 - **Author**: Mauricio Velazco, Splunk - **ID**: eb3e6702-8936-11ec-98fe-acde48001122 diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md index 510e2fbc7a..f1c81ae44f 100644 --- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md +++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-09 - **Author**: Jose Hernandez, Patrick Bareiss, Mauricio Velazco, Splunk - **ID**: 5cc67381-44fa-4111-8a37-7a230943f027 @@ -54,8 +55,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `kerberoasting_spn_request_with_rc4_encryption_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-11-linux_system_network_discovery.md b/docs/_posts/2022-02-11-linux_system_network_discovery.md index 58c7054c15..7d256c9210 100644 --- a/docs/_posts/2022-02-11-linux_system_network_discovery.md +++ b/docs/_posts/2022-02-11-linux_system_network_discovery.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to look for possible enumeration of local network configuration - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-11 - **Author**: Teoderick Contreras, Splunk - **ID**: 535cb214-8b47-11ec-a2c7-acde48001122 diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md index cc16472d78..eb1df7da2c 100644 --- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md +++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to look for dd command to overwrite file. This technique was ab - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-14 - **Author**: Teoderick Contreras, Splunk - **ID**: 9b6aae5e-8d85-11ec-b2ae-acde48001122 diff --git a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md index c915a8d3bc..d827a872a6 100644 --- a/docs/_posts/2022-02-15-detection_of_dns_tunnels.md +++ b/docs/_posts/2022-02-15-detection_of_dns_tunnels.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution) + - **Last Updated**: 2022-02-15 - **Author**: Bhavin Patel, Splunk - **ID**: 104658f4-afdc-499f-9719-17a43f9826f4 diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md index f509e24075..201c662eb3 100644 --- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md +++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-15 - **Author**: Lou Stella, Splunk - **ID**: 58adae9e-8ea3-11ec-90f6-acde48001122 @@ -51,9 +52,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a #### Macros The SPL above uses the following Macros: +* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) -* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml) Note that `windows_diskshadow_proxy_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md index 705a912265..9e294d6006 100644 --- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md +++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md @@ -26,7 +26,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -35,6 +35,7 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-15 - **Author**: Michael Haag, Splunk - **ID**: 6f42b8be-8e96-11ec-ad5a-acde48001122 diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md new file mode 100644 index 0000000000..c4424a81a2 --- /dev/null +++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md @@ -0,0 +1,112 @@ +--- +title: "Windows Disable Notification Center" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-02-17 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following search identifies a modification of registry to disable the windows notification center feature in a windows host machine. This registry modification removes notification and action center from the notification area on the task bar. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-02-17 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 1cd983c8-8fd6-11ec-a09d-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_value_name= "DisableNotificationCenter" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name +| `windows_disable_notification_center_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_notification_center_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.user +* Registry.dest +* Registry.registry_value_nam + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Known False Positives +admin or user may choose to disable this windows features. + +#### Associated Analytic story +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 48.0 | 60 | 80 | The Windows notification center was disabled on $dest$ by $user$. | + + + + +#### Reference + +* [https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html](https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/disable_notif_center/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_notification_center.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md index 8ec59c62c2..402941e829 100644 --- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md +++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to look for suspicious raw access read to drive where the maste - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-17 - **Author**: Teoderick Contreras, Splunk - **ID**: 7b83f666-900c-11ec-a2d9-acde48001122 diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md index 9793f81d0b..efc3b81d21 100644 --- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies regasm.exe with a network connection to a publ - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-18 - **Author**: Michael Haag, Splunk - **ID**: 07921114-6db4-4e2e-ae58-3ea8a52ae93f @@ -80,6 +81,7 @@ Although unlikely, limited instances of regasm.exe with a network connection may #### Associated Analytic story * [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md index 6e05b57d3f..234043c6e9 100644 --- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md +++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-18 - **Author**: Michael Haag, Splunk - **ID**: e3e7a1c0-f2b9-445c-8493-f30a63522d1a @@ -79,6 +80,7 @@ Although unlikely, limited instances of regsvcs.exe may cause a false positive. #### Associated Analytic story * [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md index 6f13c2987e..99235e2eff 100644 --- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md +++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-18 - **Author**: Mauricio Velazco, Splunk - **ID**: b0b34e2c-90de-11ec-baeb-acde48001122 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `disabled_kerberos_pre-authentication_discovery_with_powerview_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md index 16411ccc3f..af22a0c219 100644 --- a/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md +++ b/docs/_posts/2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-18 - **Author**: Mauricio Velazco, Splunk - **ID**: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `interactive_session_on_remote_endpoint_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md index 685bfda508..0a8285eb74 100644 --- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md +++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md @@ -23,7 +23,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -32,6 +32,7 @@ This search is to detect modification of registry to bypass UAC windows feature. - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras, Splunk - **ID**: 0252ca80-e30d-11eb-8aa3-acde48001122 diff --git a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md index 7a8c701f55..bbc83b6bf9 100644 --- a/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md +++ b/docs/_posts/2022-02-18-o365_excessive_authentication_failures_alert.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This search detects when an excessive number of authentication failures occur th - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-18 - **Author**: Rod Soto, Splunk - **ID**: d441364c-349c-453b-b55f-12eccab67cf9 @@ -50,8 +51,8 @@ This search detects when an excessive number of authentication failures occur th #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [o365_management_activity](https://github.com/splunk/security_content/blob/develop/macros/o365_management_activity.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `o365_excessive_authentication_failures_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md index 12adf247be..eaa34437da 100644 --- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md +++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This detection is to identify a suspicious process that tries to delete the proc - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras - **ID**: f7eda4bc-871c-11eb-b110-acde48001122 diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md index b49920bd0f..9588759a9b 100644 --- a/docs/_posts/2022-02-18-rundll32_dnsquery.md +++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This search is to detect a suspicious rundll32.exe process having a http connect - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-18 - **Author**: Teoderick Contreras, Splunk - **ID**: f1483f5e-ee29-11eb-9d23-acde48001122 @@ -77,6 +78,7 @@ unknown #### Associated Analytic story * [IcedID](/stories/icedid) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md index fb5f07ab4d..ec47142761 100644 --- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md +++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-18 - **Author**: Patrick Bareiss, Splunk - **ID**: c2590137-0b08-4985-9ec5-6ae23d92f63d diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md index 189eda191a..660215eaa6 100644 --- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md +++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 114c6bfe-9406-11ec-bcce-acde48001122 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md index bacb5577a7..1abc03d678 100644 --- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md +++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic leverages Windows Security Event 4738, `A user account wa - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-22 - **Author**: Mauricio Velazco, Splunk - **ID**: 0cb847ee-9423-11ec-b2df-acde48001122 diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md index f32a530638..be6cfab2f8 100644 --- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md +++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md @@ -25,7 +25,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -34,6 +34,7 @@ The following analytic identifies the creation or deletion of a scheduled task u - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) - **Last Updated**: 2022-02-22 - **Author**: Bhavin Patel, Splunk - **ID**: d5af132c-7c17-439c-9d31-13d55340f36c @@ -85,6 +86,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne * [DHS Report TA18-074A](/stories/dhs_report_ta18-074a) * [NOBELIUM Group](/stories/nobelium_group) * [Windows Persistence Techniques](/stories/windows_persistence_techniques) +* [Living Off The Land](/stories/living_off_the_land) #### Kill Chain Phase diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md index ac6238ba6d..52e0318430 100644 --- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md +++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to look for wmi commandlines to execute or create process. This - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-22 - **Author**: Teoderick Contreras, Splunk - **ID**: 0661c2de-93de-11ec-9833-acde48001122 diff --git a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md index 3ce4a9b462..d9c6cc1a86 100644 --- a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md +++ b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-23 - **Author**: Mauricio Velazco, Splunk - **ID**: 59b51620-94c9-11ec-b3d5-acde48001122 @@ -53,8 +54,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) #### Macros The SPL above uses the following Macros: -* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) * [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) Note that `kerberos_pre-authentication_flag_disabled_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. diff --git a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md index 1ec08a0014..a3859a0ae9 100644 --- a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md +++ b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will identify suspicious system event of services that was modifie - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 9c2620a8-94a1-11ec-b40c-acde48001122 diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md index 10c450fc63..49520c4703 100644 --- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md +++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic will identify suspicious excessive number of system events of serv - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: c3f85976-94a5-11ec-9a58-acde48001122 diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md index d71ab4aad1..753121473e 100644 --- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md +++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md @@ -19,7 +19,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,6 +28,7 @@ This analytic is to look for process commandline that contains named pipe. This - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: e64399d4-94a8-11ec-a9da-acde48001122 diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md index 883878904f..eac8fe2305 100644 --- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md +++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -29,6 +29,7 @@ This analytic is to look for suspicious modification or creation of registry to - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-23 - **Author**: Teoderick Contreras, Splunk - **ID**: 25212358-948e-11ec-ad47-acde48001122 diff --git a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md index 400633f3d6..5481d60106 100644 --- a/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md +++ b/docs/_posts/2022-02-24-aws_lambda_updatefunctioncode.md @@ -17,7 +17,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -25,7 +25,8 @@ This analytic is designed to detect IAM users attempting to update/modify AWS la - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-02-24 - **Author**: Bhavin Patel, Splunk - **ID**: 211b80d3-6340-4345-11ad-212bf3d0d111 diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md index 8c4ad7dfb7..6a99a51280 100644 --- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md +++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ The following analytic identifies a process that is attempting to disable the ab - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-25 - **Author**: Michael Haag, Splunk - **ID**: 59e54602-9680-11ec-a8a6-acde48001122 diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md index ce871752af..f376ed2933 100644 --- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md +++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to look for suspicious file creation in the critical folder lik - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-25 - **Author**: Teoderick Contreras, Bhavin Patel, Splunk - **ID**: 0dbcac64-963c-11ec-bf04-acde48001122 diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md index f9db657d1a..d80b250b3e 100644 --- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md +++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md @@ -21,7 +21,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -30,6 +30,7 @@ This analytic is to look for suspicious raw access read to device disk partition - **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-02-25 - **Author**: Teoderick Contreras, Splunk - **ID**: a85aa37e-9647-11ec-90c5-acde48001122 diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md new file mode 100644 index 0000000000..2ab840a0d8 --- /dev/null +++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md @@ -0,0 +1,107 @@ +--- +title: "Excessive distinct processes from Windows Temp" +excerpt: "Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-02-28 +toc: true +toc_label: "" +tags: + - Command and Scripting Interpreter + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Microsoft Windows](https://splunkbase.splunk.com/app/742) +- **Last Updated**: 2022-02-28 +- **Author**: Michael Hart, Mauricio Velazco, Splunk +- **ID**: 23587b6a-c479-11eb-b671-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +#### Search + +``` + +| tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m +| where distinct_process_count > 37 +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `excessive_distinct_processes_from_windows_temp_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `excessive_distinct_processes_from_windows_temp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.process +* Processes.dest +* Processes.user + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. + +#### Known False Positives +Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. + +#### Associated Analytic story +* [Meterpreter](/stories/meterpreter) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | Multiple processes were executed out of windows\temp within a short amount of time on $dest$. | + + + + +#### Reference + +* [https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/](https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md index 3b43905f67..cb0913661a 100644 --- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md +++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md @@ -18,7 +18,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -27,6 +27,7 @@ This analytic is to look for suspicious registry modification related to file co - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + - **Last Updated**: 2022-03-02 - **Author**: Teoderick Contreras, Splunk - **ID**: b7548c2e-9a10-11ec-99e3-acde48001122 diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md index cf532de1b8..40469587ca 100644 --- a/docs/_posts/2022-03-03-aws_createaccesskey.md +++ b/docs/_posts/2022-03-03-aws_createaccesskey.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-03-03 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6340-4345-11ad-212bf3d0d111 diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md index 1ad05f3990..595f9c2fe6 100644 --- a/docs/_posts/2022-03-03-aws_updateloginprofile.md +++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md @@ -20,7 +20,7 @@ tags: -[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} #### Description @@ -28,7 +28,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi - **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud -- **Datamodel**: + + - **Last Updated**: 2022-03-03 - **Author**: Bhavin Patel, Splunk - **ID**: 2a9b80d3-6a40-4115-11ad-212bf3d0d111 diff --git a/docs/_posts/2022-03-04-macos_lolbin.md b/docs/_posts/2022-03-04-macos_lolbin.md new file mode 100644 index 0000000000..c0853fa1d4 --- /dev/null +++ b/docs/_posts/2022-03-04-macos_lolbin.md @@ -0,0 +1,116 @@ +--- +title: "MacOS LOLbin" +excerpt: "Unix Shell +, Command and Scripting Interpreter +" +categories: + - Endpoint +last_modified_at: 2022-03-04 +toc: true +toc_label: "" +tags: + - Unix Shell + - Command and Scripting Interpreter + - Execution + - Execution + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +Detect multiple executions of Living off the Land (LOLbin) binaries in a short period of time. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-04 +- **Author**: Patrick Bareiss, Splunk +- **ID**: 58d270fb-5b39-418e-a855-4b8ac046805e + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1059.004](https://attack.mitre.org/techniques/T1059/004/) | Unix Shell | Execution | + +| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution | + +#### Search + +``` +`osquery` name=es_process_events columns.cmdline IN ("find*", "crontab*", "screencapture*", "openssl*", "curl*", "wget*", "killall*", "funzip*") +| rename columns.* as * +| stats min(_time) as firstTime max(_time) as lastTime values(cmdline) as cmdline, values(pid) as pid, values(parent) as parent, values(path) as path, values(signing_id) as signing_id, dc(path) as dc_path by username host +| rename username as User, cmdline as process, path as process_path +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `macos_lolbin_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [osquery](https://github.com/splunk/security_content/blob/develop/macros/osquery.yml) + +Note that `macos_lolbin_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* columns.cmdline +* columns.pid +* columns.parent +* columns.path +* columns.signing_id +* columns.username +* host + + +#### How To Implement +This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery. + +#### Known False Positives +None identified. + +#### Associated Analytic story +* [Living Off The Land](/stories/living_off_the_land) + + +#### Kill Chain Phase +* Actions on Objectives + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 25.0 | 50 | 50 | Multiplle LOLbin are executed on host $host$ by user $user$ | + + + + +#### Reference + +* [https://osquery.readthedocs.io/en/stable/deployment/process-auditing/](https://osquery.readthedocs.io/en/stable/deployment/process-auditing/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/macos_lolbin/osquery.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.004/macos_lolbin/osquery.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/macos_lolbin.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md new file mode 100644 index 0000000000..2bdcc2c6df --- /dev/null +++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md @@ -0,0 +1,119 @@ +--- +title: "Windows Disable Change Password Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable change password feature of the windows host. This registry modification may disables the Change Password button on the Windows Security dialog box (which appears when you press Ctrl+Alt+Del). As a result, users cannot change their Windows password on demand. This technique was seen in some malware family like ransomware to prevent the user to change the password after ownning the network or a system during attack. This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 0df33e1a-9ef6-11ec-a1ad-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_disable_change_password_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_change_password_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive. + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification in "DisableChangePassword" on $dest$ | + + + + +#### Reference + +* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_heartbleed.thdobah) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_change_password_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md new file mode 100644 index 0000000000..3f7ae776a3 --- /dev/null +++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md @@ -0,0 +1,120 @@ +--- +title: "Windows Disable Lock Workstation Feature Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable Lock Computer windows features. This registry modification prevent the user from locking its screen or computer that are being abused by several malware for example ransomware. This technique was used by threat actor to make its payload more impactful to the compromised host. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: c82adbc6-9f00-11ec-a81f-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation" Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_disable_lock_workstation_feature_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_lock_workstation_feature_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification in "DisableLockWorkstation" on $dest$ | + + + + +#### Reference + +* [https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/](https://www.bleepingcomputer.com/news/security/in-dev-ransomware-forces-you-do-to-survey-before-unlocking-computer/) +* [https://heimdalsecurity.com/blog/fatalrat-targets-telegram/](https://heimdalsecurity.com/blog/fatalrat-targets-telegram/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md new file mode 100644 index 0000000000..e9bcc91a9b --- /dev/null +++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md @@ -0,0 +1,120 @@ +--- +title: "Windows Disable LogOff Button Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable logoff feature in windows host. This registry when enable will prevent users to log off of the system by using any method, including programs run from the command line, such as scripts. It also disables or removes all menu items and buttons that log the user off of the system. This technique was seen abused by ransomware malware to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: b2fb6830-9ed1-11ec-9fcb-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("NoLogOff", "StartMenuLogOff") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_disable_logoff_button_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_logoff_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification in "NoLogOff" on $dest$ | + + + + +#### Reference + +* [https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774](https://www.hybrid-analysis.com/sample/e2d4018fd3bd541c153af98ef7c25b2bf4a66bc3bfb89e437cde89fd08a9dd7b/5b1f4d947ca3e10f22714774) +* [https://malwiki.org/index.php?title=DigiPop.xp](https://malwiki.org/index.php?title=DigiPop.xp) +* [https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2](https://www.trendmicro.com/vinfo/be/threat-encyclopedia/search/js_noclose.e/2) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md new file mode 100644 index 0000000000..03cf886687 --- /dev/null +++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md @@ -0,0 +1,118 @@ +--- +title: "Windows Disable Shutdown Button Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable shutdown button on the logon user. This technique was seen in several malware especially in ransomware family like killdisk malware variant to make the compromised host un-useful and hard to remove other registry modification made on the machine that needs restart to take effect. This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 55fb2958-9ecd-11ec-a06a-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon" Registry.registry_value_data = "0x00000000") OR (Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose" Registry.registry_value_data = "0x00000001") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_disable_shutdown_button_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_shutdown_button_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed. + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification in "shutdownwithoutlogon" on $dest$ | + + + + +#### Reference + +* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.msil.screenlocker.a/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md new file mode 100644 index 0000000000..684deccbde --- /dev/null +++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md @@ -0,0 +1,121 @@ +--- +title: "Windows Disable Windows Group Policy Features Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to disable windows features. These techniques are seen in several ransomware malware to impair the compromised host to make it hard for analyst to mitigate or response from the attack. Disabling these known features make the analysis and forensic response more hard. Disabling these feature is not so common but can still be implemented by the administrator for security purposes. In this scenario filters for users that are allowed doing this is needed. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: 63a449ae-9f04-11ec-945e-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\*" Registry.registry_value_name IN ("NoDesktop", "NoFind", "NoControlPanel", "NoFileMenu", "NoSetTaskbar", "NoTrayContextMenu", "TaskbarLockAll", "NoThemesTab","NoPropertiesMyDocuments","NoVisualStyleChoice","NoColorChoice","NoPropertiesMyDocuments") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_disable_windows_group_policy_features_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_disable_windows_group_policy_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification to disable windows features on $dest$ | + + + + +#### Reference + +* [https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en](https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en) +* [https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis](https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis) +* [https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details](https://www.virustotal.com/gui/file/2d7855bf6470aa323edf2949b54ce2a04d9e38770f1322c3d0420c2303178d91/details) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md new file mode 100644 index 0000000000..61663944b6 --- /dev/null +++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md @@ -0,0 +1,119 @@ +--- +title: "Windows Hide Notification Features Through Registry" +excerpt: "Modify Registry +" +categories: + - Endpoint +last_modified_at: 2022-03-08 +toc: true +toc_label: "" +tags: + - Modify Registry + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +This analytic is to detect a suspicious registry modification to hide common windows notification feature from compromised host. This technique was seen in some ransomware family to add more impact to its payload that are visually seen by user aside from the encrypted files and ransomware notes. Even this a good anomaly detection, administrator may implement this changes for auditing or security reason. In this scenario filter is needed. + +- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-08 +- **Author**: Teoderick Contreras, Splunk +- **ID**: cafa4bce-9f06-11ec-a7b2-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\*" Registry.registry_value_name IN ("HideClock", "HideSCAHealth", "HideSCANetwork", "HideSCAPower", "HideSCAVolume") Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid +| `drop_dm_object_name(Registry)` +|rename process_guid as proc_guid +|join proc_guid, _time [ +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid +| `drop_dm_object_name(Processes)` +|rename process_guid as proc_guid +| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] +| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data +| `windows_hide_notification_features_through_registry_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_hide_notification_features_through_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Registry.registry_key_name +* Registry.registry_path +* Registry.registry_value_name +* Registry.dest Registry.user +* Processes.process_id +* Processes.process_name +* Processes.process +* Processes.dest +* Processes.parent_process_name +* Processes.parent_process +* Processes.process_guid + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. + +#### Known False Positives +unknown + +#### Associated Analytic story +* [Ransomware](/stories/ransomware) +* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Registry modification to hide windows notification on $dest$ | + + + + +#### Reference + +* [https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/](https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Ransom.Win32.ONALOCKER.A/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml) \| *version*: **1** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md new file mode 100644 index 0000000000..02c48e6638 --- /dev/null +++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md @@ -0,0 +1,124 @@ +--- +title: "Detect Regasm with no Command Line Arguments" +excerpt: "Signed Binary Proxy Execution +, Regsvcs/Regasm +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Signed Binary Proxy Execution + - Regsvcs/Regasm + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: c3bc1430-04e7-4178-835f-047d8e6e97df + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(regasm\.exe.{0,4}$)" +| `detect_regasm_with_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `detect_regasm_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. + +#### Associated Analytic story +* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) + + +#### Kill Chain Phase +* Actions on Objectives + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md) +* [https://lolbas-project.github.io/lolbas/Binaries/Regasm/](https://lolbas-project.github.io/lolbas/Binaries/Regasm/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md new file mode 100644 index 0000000000..02eb1f0c6b --- /dev/null +++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md @@ -0,0 +1,124 @@ +--- +title: "Detect Regsvcs with No Command Line Arguments" +excerpt: "Signed Binary Proxy Execution +, Regsvcs/Regasm +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Signed Binary Proxy Execution + - Regsvcs/Regasm + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: 6b74d578-a02e-4e94-a0d1-39440d0bf254 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +| [T1218.009](https://attack.mitre.org/techniques/T1218/009/) | Regsvcs/Regasm | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(regsvcs\.exe.{0,4}$)" +| `detect_regsvcs_with_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `detect_regsvcs_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. + +#### Associated Analytic story +* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity) +* [Living Off The Land](/stories/living_off_the_land) + + +#### Kill Chain Phase +* Actions on Objectives + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. | + + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1218/009/](https://attack.mitre.org/techniques/T1218/009/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md) +* [https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/](https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md new file mode 100644 index 0000000000..5e406c1dad --- /dev/null +++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md @@ -0,0 +1,117 @@ +--- +title: "DLLHost with no Command Line Arguments with Network" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: f1c07594-a141-11eb-8407-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(dllhost\.exe.{0,4}$)" +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `dllhost_with_no_command_line_arguments_with_network_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `dllhost_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventID +* process_name +* process_id +* parent_process_name +* dest_port +* process_path + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. + +#### Known False Positives +Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. | + + + + +#### Reference + +* [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) +* [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md new file mode 100644 index 0000000000..b7638adbb9 --- /dev/null +++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md @@ -0,0 +1,117 @@ +--- +title: "GPUpdate with no Command Line Arguments with Network" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: 2c853856-a140-11eb-a5b5-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(gpupdate\.exe.{0,4}$)" +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `gpupdate_with_no_command_line_arguments_with_network_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `gpupdate_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* EventID +* process_name +* process_id +* parent_process_name +* dest_port +* process_path + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 81.0 | 90 | 90 | Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. | + + + + +#### Reference + +* [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) +* [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md new file mode 100644 index 0000000000..3f71393d79 --- /dev/null +++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md @@ -0,0 +1,138 @@ +--- +title: "Rundll32 with no Command Line Arguments with Network" +excerpt: "Signed Binary Proxy Execution +, Rundll32 +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Signed Binary Proxy Execution + - Rundll32 + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-34527 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: 35307032-a12d-11eb-835f-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(rundll32\.exe.{0,4}$)" +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `rundll32_with_no_command_line_arguments_with_network_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `rundll32_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. + +#### Associated Analytic story +* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Cobalt Strike](/stories/cobalt_strike) +* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 70 | 100 | A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ | + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md) +* [https://lolbas-project.github.io/lolbas/Binaries/Rundll32](https://lolbas-project.github.io/lolbas/Binaries/Rundll32) +* [https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/](https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml) \| *version*: **4** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md new file mode 100644 index 0000000000..3fdcedd431 --- /dev/null +++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md @@ -0,0 +1,115 @@ +--- +title: "SearchProtocolHost with no Command Line with Network" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: b690df8c-a145-11eb-a38b-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `searchprotocolhost_with_no_command_line_with_network_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `searchprotocolhost_with_no_command_line_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* process_name +* process_id +* parent_process_name +* dest_port +* process_path + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 70.0 | 70 | 100 | A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ | + + + + +#### Reference + +* [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md new file mode 100644 index 0000000000..47b4339f68 --- /dev/null +++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md @@ -0,0 +1,118 @@ +--- +title: "Suspicious DLLHost no Command Line Arguments" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: ff61e98c-0337-4593-a78f-72a676c56f26 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(dllhost\.exe.{0,4}$)" +| `suspicious_dllhost_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) + +Note that `suspicious_dllhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ | + + + + +#### Reference + +* [https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile](https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile) +* [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md new file mode 100644 index 0000000000..7b8fccfa91 --- /dev/null +++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md @@ -0,0 +1,118 @@ +--- +title: "Suspicious GPUpdate no Command Line Arguments" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: f308490a-473a-40ef-ae64-dd7a6eba284a + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(gpupdate\.exe.{0,4}$)" +| `suspicious_gpupdate_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `suspicious_gpupdate_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ | + + + + +#### Reference + +* [https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile](https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile) +* [https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/](https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md new file mode 100644 index 0000000000..b8d6b49087 --- /dev/null +++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md @@ -0,0 +1,133 @@ +--- +title: "Suspicious Rundll32 no Command Line Arguments" +excerpt: "Signed Binary Proxy Execution +, Rundll32 +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Signed Binary Proxy Execution + - Rundll32 + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - CVE-2021-34527 + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +| [T1218.011](https://attack.mitre.org/techniques/T1218/011/) | Rundll32 | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(rundll32\.exe.{0,4}$)" +| `suspicious_rundll32_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `suspicious_rundll32_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. + +#### Associated Analytic story +* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity) +* [Cobalt Strike](/stories/cobalt_strike) +* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527) + + +#### Kill Chain Phase +* Actions on Objectives + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ | + + +#### CVE + +| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) | +| ----------- | ----------- | -------------- | +| [CVE-2021-34527](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) | Windows Print Spooler Remote Code Execution Vulnerability | 9.0 | + + + +#### Reference + +* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md) +* [https://lolbas-project.github.io/lolbas/Binaries/Rundll32](https://lolbas-project.github.io/lolbas/Binaries/Rundll32) +* [https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/](https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md new file mode 100644 index 0000000000..5586c92696 --- /dev/null +++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md @@ -0,0 +1,116 @@ +--- +title: "Suspicious SearchProtocolHost no Command Line Arguments" +excerpt: "Process Injection +" +categories: + - Endpoint +last_modified_at: 2022-03-15 +toc: true +toc_label: "" +tags: + - Process Injection + - Defense Evasion + - Privilege Escalation + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) +- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709) +- **Last Updated**: 2022-03-15 +- **Author**: Michael Haag, Splunk +- **ID**: f52d2db8-31f9-4aa7-a176-25779effe55c + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" +| `suspicious_searchprotocolhost_no_command_line_arguments_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `suspicious_searchprotocolhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Limited false positives may be present in small environments. Tuning may be required based on parent process. + +#### Associated Analytic story +* [Cobalt Strike](/stories/cobalt_strike) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 49.0 | 70 | 70 | Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ | + + + + +#### Reference + +* [https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc](https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml) \| *version*: **3** \ No newline at end of file diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md new file mode 100644 index 0000000000..c7d8605c5c --- /dev/null +++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md @@ -0,0 +1,132 @@ +--- +title: "Windows InstallUtil Remote Network Connection" +excerpt: "InstallUtil +, Signed Binary Proxy Execution +" +categories: + - Endpoint +last_modified_at: 2022-03-16 +toc: true +toc_label: "" +tags: + - InstallUtil + - Signed Binary Proxy Execution + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ +When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ +If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-16 +- **Author**: Michael Haag, Splunk +- **ID**: 4fbf9270-43da-11ec-9486-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `windows_installutil_remote_network_connection_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_installutil_remote_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id +* Ports.process_guid +* Ports.dest +* Ports.dest_port + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. + +#### Associated Analytic story +* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) +* [Living Off The Land](/stories/living_off_the_land) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. | + + + + +#### Reference + +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_installutil_remote_network_connection.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md new file mode 100644 index 0000000000..7f7ba9dd60 --- /dev/null +++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md @@ -0,0 +1,135 @@ +--- +title: "Windows InstallUtil Uninstall Option with Network" +excerpt: "InstallUtil +, Signed Binary Proxy Execution +" +categories: + - Endpoint +last_modified_at: 2022-03-16 +toc: true +toc_label: "" +tags: + - InstallUtil + - Signed Binary Proxy Execution + - Defense Evasion + - Defense Evasion + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + - Endpoint +--- + + + +[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success} + +#### Description + +The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ +InstallUtil uses the functions install and uninstall within the System.Configuration.Install namespace to process .net assembly. Install function requires admin privileges, however, uninstall function can be run as an unprivileged user.\ +When `InstallUtil.exe` is used in a malicous manner, the path to an executable on the filesystem is typically specified. Take note of the parent process. In a suspicious instance, this will be spawned from a non-standard process like `Cmd.exe`, `PowerShell.exe` or `Explorer.exe`. \ +If used by a developer, typically this will be found with multiple command-line switches/arguments and spawn from Visual Studio. \ +During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. + +- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types) +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) + +- **Last Updated**: 2022-03-16 +- **Author**: Michael Haag, Splunk +- **ID**: 1a52c836-43ef-11ec-a36c-acde48001122 + + +#### [ATT&CK](https://attack.mitre.org/) + +| ID | Technique | Tactic | +| -------------- | ---------------- |-------------------- | +| [T1218.004](https://attack.mitre.org/techniques/T1218/004/) | InstallUtil | Defense Evasion | + +| [T1218](https://attack.mitre.org/techniques/T1218/) | Signed Binary Proxy Execution | Defense Evasion | + +#### Search + +``` + +| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| join process_id [ +| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port +| `drop_dm_object_name(All_Traffic)` +| rename dest as C2 ] +| table _time dest parent_process_name process_name process_path process process_id dest_port C2 +| `windows_installutil_uninstall_option_with_network_filter` +``` + +#### Macros +The SPL above uses the following Macros: +* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml) +* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml) +* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml) + +Note that `windows_installutil_uninstall_option_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL. + +#### Required field +* _time +* Processes.dest +* Processes.user +* Processes.parent_process_name +* Processes.parent_process +* Processes.original_file_name +* Processes.process_name +* Processes.process +* Processes.process_id +* Processes.parent_process_path +* Processes.process_path +* Processes.parent_process_id +* Ports.process_guid +* Ports.dest +* Ports.dest_port + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. + +#### Known False Positives +Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. + +#### Associated Analytic story +* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil) +* [Living Off The Land](/stories/living_off_the_land) + + +#### Kill Chain Phase +* Exploitation + + + +#### RBA + +| Risk Score | Impact | Confidence | Message | +| ----------- | ----------- |--------------|--------------| +| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. | + + + + +#### Reference + +* [https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12](https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12) +* [https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md](https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md) +* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md) + + + +#### Test Dataset +Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui). +Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server) + + +* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.004/atomic_red_team/windows-sysmon.log) + + + +[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_stories/active_directory_kerberos_attacks.md b/docs/_stories/active_directory_kerberos_attacks.md index cfe54ca30c..f9a6ae633c 100644 --- a/docs/_stories/active_directory_kerberos_attacks.md +++ b/docs/_stories/active_directory_kerberos_attacks.md @@ -37,14 +37,14 @@ Kerberos, initially named after Cerberus, the three-headed dog in Greek mytholog | [Kerberos Pre-Authentication Flag Disabled in UserAccountControl](/endpoint/kerberos_pre-authentication_flag_disabled_in_useraccountcontrol/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting)| TTP | | [Kerberos Pre-Authentication Flag Disabled with PowerShell](/endpoint/kerberos_pre-authentication_flag_disabled_with_powershell/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting)| TTP | | [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket)| TTP | -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Rubeus Command Line Parameters](/endpoint/rubeus_command_line_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [AS-REP Roasting](/tags/#as-rep-roasting)| TTP | | [Rubeus Kerberos Ticket Exports Through Winlogon Access](/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket)| TTP | | [ServicePrincipalNames Discovery with PowerShell](/endpoint/serviceprincipalnames_discovery_with_powershell/) | [Kerberoasting](/tags/#kerberoasting)| TTP | | [ServicePrincipalNames Discovery with SetSPN](/endpoint/serviceprincipalnames_discovery_with_setspn/) | [Kerberoasting](/tags/#kerberoasting)| TTP | | [Unusual Number of Kerberos Service Tickets Requested](/endpoint/unusual_number_of_kerberos_service_tickets_requested/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting)| Anomaly | +| [Windows Disabled Users Failing To Authenticate Kerberos](/endpoint/windows_disabled_users_failing_to_authenticate_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | #### Reference diff --git a/docs/_stories/active_directory_password_spraying.md b/docs/_stories/active_directory_password_spraying.md index 0e0242d6df..64daa552ee 100644 --- a/docs/_stories/active_directory_password_spraying.md +++ b/docs/_stories/active_directory_password_spraying.md @@ -32,14 +32,14 @@ Specifically, this Analytic Story is focused on detecting possible Password Spra | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | -| [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | -| [Multiple Users Attempting To Authenticate Using Explicit Credentials](/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Users Failing To Authenticate From Host Using Kerberos](/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | | [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Windows Disabled Users Failing To Authenticate Kerberos](/endpoint/windows_disabled_users_failing_to_authenticate_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Windows Invalid Users Failed Authentication via Kerberos](/endpoint/windows_invalid_users_failed_authentication_via_kerberos/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | +| [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force)| Anomaly | #### Reference diff --git a/docs/_stories/kubernetes_sensitive_role_activity.md b/docs/_stories/kubernetes_sensitive_role_activity.md index 6afd71dcc7..9547787aff 100644 --- a/docs/_stories/kubernetes_sensitive_role_activity.md +++ b/docs/_stories/kubernetes_sensitive_role_activity.md @@ -33,7 +33,7 @@ Kubernetes is the most used container orchestration platform, this orchestration | [Kubernetes AWS detect most active service accounts by pod](/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod/) | None| Hunting | | [Kubernetes AWS detect RBAC authorization by account](/deprecated/kubernetes_aws_detect_rbac_authorization_by_account/) | None| Hunting | | [Kubernetes AWS detect sensitive role access](/deprecated/kubernetes_aws_detect_sensitive_role_access/) | None| Hunting | -| [Kubernetes Azure detect most active service accounts by pod namespace](/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace/) | None| Hunting | +| [Kubernetes Azure active service accounts by pod namespace](/deprecated/kubernetes_azure_active_service_accounts_by_pod_namespace/) | None| Hunting | | [Kubernetes Azure detect RBAC authorization by account](/deprecated/kubernetes_azure_detect_rbac_authorization_by_account/) | None| Hunting | | [Kubernetes Azure detect sensitive role access](/deprecated/kubernetes_azure_detect_sensitive_role_access/) | None| Hunting | | [Kubernetes GCP detect RBAC authorizations by account](/deprecated/kubernetes_gcp_detect_rbac_authorizations_by_account/) | None| Hunting | diff --git a/docs/_stories/living_off_the_land.md b/docs/_stories/living_off_the_land.md index 5eaef9e662..1e782f2302 100644 --- a/docs/_stories/living_off_the_land.md +++ b/docs/_stories/living_off_the_land.md @@ -1,6 +1,6 @@ --- title: "Living Off The Land" -last_modified_at: 2022-02-17 +last_modified_at: 2022-03-16 toc: true toc_label: "" tags: @@ -8,31 +8,103 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Endpoint + - Actions on Objectives - Exploitation + - Installation --- [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success} #### Description -Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment. +Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint) -- **Last Updated**: 2022-02-17 +- **Last Updated**: 2022-03-16 - **Author**: Lou Stella, Splunk - **ID**: 6f7982e2-900b-11ec-a54a-acde48001122 #### Narrative -Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software. +Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. #### Detections | Name | Technique | Type | | ----------- | ----------- |--------------| +| [BITS Job Persistence](/endpoint/bits_job_persistence/) | [BITS Jobs](/tags/#bits-jobs)| TTP | +| [BITSAdmin Download File](/endpoint/bitsadmin_download_file/) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | +| [CertUtil Download With URLCache and Split Arguments](/endpoint/certutil_download_with_urlcache_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | +| [CertUtil Download With VerifyCtl and Split Arguments](/endpoint/certutil_download_with_verifyctl_and_split_arguments/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP | +| [Certutil exe certificate extraction](/endpoint/certutil_exe_certificate_extraction/) | None| TTP | +| [CertUtil With Decode Argument](/endpoint/certutil_with_decode_argument/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information)| TTP | +| [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting | +| [Control Loading from World Writable Directory](/endpoint/control_loading_from_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel)| TTP | +| [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Detect HTML Help Renamed](/endpoint/detect_html_help_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| Hunting | +| [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file)| TTP | +| [Detect mshta inline hta execution](/endpoint/detect_mshta_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect mshta renamed](/endpoint/detect_mshta_renamed/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| Hunting | +| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Detect Regasm Spawning a Process](/endpoint/detect_regasm_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with Network Connection](/endpoint/detect_regasm_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regasm with no Command Line Arguments](/endpoint/detect_regasm_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs Spawning a Process](/endpoint/detect_regsvcs_spawning_a_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with Network Connection](/endpoint/detect_regsvcs_with_network_connection/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvcs with No Command Line Arguments](/endpoint/detect_regsvcs_with_no_command_line_arguments/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvcs/Regasm](/tags/#regsvcs/regasm)| TTP | +| [Detect Regsvr32 Application Control Bypass](/endpoint/detect_regsvr32_application_control_bypass/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Detect Rundll32 Inline HTA Execution](/endpoint/detect_rundll32_inline_hta_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | +| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting | | [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | +| [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP | +| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP | +| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP | +| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP | +| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Regsvr32 with Known Silent Switch Cmdline](/endpoint/regsvr32_with_known_silent_switch_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly | +| [Remote WMI Command Attempt](/endpoint/remote_wmi_command_attempt/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation)| TTP | +| [Rundll32 Control RunDLL Hunt](/endpoint/rundll32_control_rundll_hunt/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| Hunting | +| [Rundll32 Control RunDLL World Writable Directory](/endpoint/rundll32_control_rundll_world_writable_directory/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Create Remote Thread To A Process](/endpoint/rundll32_create_remote_thread_to_a_process/) | [Process Injection](/tags/#process-injection)| TTP | +| [Rundll32 CreateRemoteThread In Browser](/endpoint/rundll32_createremotethread_in_browser/) | [Process Injection](/tags/#process-injection)| TTP | +| [Rundll32 DNSQuery](/endpoint/rundll32_dnsquery/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Process Creating Exe Dll Files](/endpoint/rundll32_process_creating_exe_dll_files/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Rundll32 Shimcache Flush](/endpoint/rundll32_shimcache_flush/) | [Modify Registry](/tags/#modify-registry)| TTP | +| [RunDLL Loading DLL By Ordinal](/endpoint/rundll_loading_dll_by_ordinal/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Schedule Task with HTTP Command Arguments](/endpoint/schedule_task_with_http_command_arguments/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [Schedule Task with Rundll32 Command Trigger](/endpoint/schedule_task_with_rundll32_command_trigger/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [Scheduled Task Creation on Remote Endpoint using At](/endpoint/scheduled_task_creation_on_remote_endpoint_using_at/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows))| TTP | +| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [Scheduled Task Initiation on Remote Endpoint](/endpoint/scheduled_task_initiation_on_remote_endpoint/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP | +| [Schtasks scheduling job on remote system](/endpoint/schtasks_scheduling_job_on_remote_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | +| [Services LOLBAS Execution Process Spawn](/endpoint/services_lolbas_execution_process_spawn/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service)| TTP | +| [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities)| Hunting | +| [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution)| TTP | +| [Suspicious msbuild path](/endpoint/suspicious_msbuild_path/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| TTP | +| [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild)| TTP | +| [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild)| TTP | +| [Suspicious mshta child process](/endpoint/suspicious_mshta_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious mshta spawn](/endpoint/suspicious_mshta_spawn/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP | +| [Suspicious Regsvr32 Register Suspicious Path](/endpoint/suspicious_regsvr32_register_suspicious_path/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| TTP | +| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP | +| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly | +| [Svchost LOLBAS Execution Process Spawn](/endpoint/svchost_lolbas_execution_process_spawn/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP | | [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | +| [Windows InstallUtil Remote Network Connection](/endpoint/windows_installutil_remote_network_connection/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | +| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP | | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | #### Reference @@ -41,4 +113,4 @@ Living Off The Land refers to an attacker methodology of using software already -[*source*](https://github.com/splunk/security_content/tree/develop/stories/living_off_the_land.yml) \| *version*: **1** \ No newline at end of file +[*source*](https://github.com/splunk/security_content/tree/develop/stories/living_off_the_land.yml) \| *version*: **2** \ No newline at end of file diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md index 8f85b17083..7987d57e67 100644 --- a/docs/_stories/malicious_powershell.md +++ b/docs/_stories/malicious_powershell.md @@ -46,7 +46,7 @@ Most recently we have added new content related to PowerShell Script Block loggi | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments](/deprecated/malicious_powershell_process_-_multiple_suspicious_command-line_arguments/) | [PowerShell](/tags/#powershell)| TTP | +| [Suspicious Powershell Command-Line Arguments](/deprecated/suspicious_powershell_command-line_arguments/) | [PowerShell](/tags/#powershell)| TTP | | [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | | [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | | [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | @@ -62,7 +62,7 @@ Most recently we have added new content related to PowerShell Script Block loggi | [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP | | [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell)| TTP | | [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP | -| [PowerShell Loading DotNET into Memory via System Reflection Assembly](/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | +| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | | [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | | [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information)| TTP | | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP | diff --git a/docs/_stories/meterpreter.md b/docs/_stories/meterpreter.md index 8520bdc4f2..8e8f3371d8 100644 --- a/docs/_stories/meterpreter.md +++ b/docs/_stories/meterpreter.md @@ -33,7 +33,7 @@ While investigating a detection related to this analytic story, please bear in m | Name | Technique | Type | | ----------- | ----------- |--------------| -| [Excessive number of distinct processes created in Windows Temp folder](/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | +| [Excessive distinct processes from Windows Temp](/endpoint/excessive_distinct_processes_from_windows_temp/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly | | [Excessive number of taskhost processes](/endpoint/excessive_number_of_taskhost_processes/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery)| Anomaly | #### Reference diff --git a/docs/_stories/proxyshell.md b/docs/_stories/proxyshell.md index 54880e593f..c4f382c5f1 100644 --- a/docs/_stories/proxyshell.md +++ b/docs/_stories/proxyshell.md @@ -36,7 +36,7 @@ During Pwn2Own April 2021, a security researcher demonstrated an attack chain t | [W3WP Spawning Shell](/endpoint/w3wp_spawning_shell/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell)| TTP | | [Exchange PowerShell Abuse via SSRF](/endpoint/exchange_powershell_abuse_via_ssrf/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | | [Exchange PowerShell Module Usage](/endpoint/exchange_powershell_module_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP | -| [Microsoft Exchange Mailbox Replication service writing Active Server Pages](/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | +| [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | #### Reference diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md index c72f4495ad..62a87b3a5c 100644 --- a/docs/_stories/ransomware.md +++ b/docs/_stories/ransomware.md @@ -89,16 +89,22 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP | | [WBAdmin Delete System Backups](/endpoint/wbadmin_delete_system_backups/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP | | [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp)| TTP | +| [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable LogOff Button Through Registry](/endpoint/windows_disable_logoff_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction)| TTP | +| [Windows Disable Shutdown Button Through Registry](/endpoint/windows_disable_shutdown_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows DiskCryptor Usage](/endpoint/windows_diskcryptor_usage/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact)| Hunting | | [Windows DotNet Binary in Non Standard Path](/endpoint/windows_dotnet_binary_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows Event Log Cleared](/endpoint/windows_event_log_cleared/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs)| TTP | +| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP | | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool)| TTP | | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools)| TTP | | [WinEvent Scheduled Task Created to Spawn Shell](/endpoint/winevent_scheduled_task_created_to_spawn_shell/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | | [WinEvent Scheduled Task Created Within Public Path](/endpoint/winevent_scheduled_task_created_within_public_path/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP | -| [Microsoft Exchange Mailbox Replication service writing Active Server Pages](/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | +| [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application)| TTP | | [Spike in File Writes](/endpoint/spike_in_file_writes/) | None| Anomaly | | [Unusually Long Command Line](/endpoint/unusually_long_command_line/) | None| Anomaly | | [Unusually Long Command Line - MLTK](/endpoint/unusually_long_command_line_-_mltk/) | None| Anomaly | diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md index e219db7794..a8916f0d49 100644 --- a/docs/_stories/windows_defense_evasion_tactics.md +++ b/docs/_stories/windows_defense_evasion_tactics.md @@ -66,10 +66,15 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP | | [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP | | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | +| [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable Notification Center](/endpoint/windows_disable_notification_center/) | [Modify Registry](/tags/#modify-registry)| Anomaly | +| [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | | [Windows Event For Service Disabled](/endpoint/windows_event_for_service_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting | | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP | +| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly | | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP | | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection)| Anomaly | | [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP | diff --git a/requirements.txt b/requirements.txt index 239427f644..db54162106 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,4 +6,5 @@ pydantic pytest PyYAML questionary -requests \ No newline at end of file +requests +xmltodict