adding portscan detections

detections/application/windows_increase_in_group_or_object_modification_activity.yml

@@ -0,0 +1,51 @@
+name: Windows Increase in Group or Object Modification Activity
+id: 4f9564dd-a204-4f22-b375-4dfca3a68731
+version: 1
+date: '2023-10-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- XmlWinEventLog:Security
+description: Increase in group or AD object modifications. 
+search: "`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)\n| bucket\
+  \ span=5m _time \n| stats values(object) as object, dc(object) as objectCount, values(src_user_category)\
+  \ as src_user_category, values(dest) as dest, values(dest_category) as dest_category\
+  \ by _time, src_user, signature, status\n| eventstats avg(objectCount) as comp_avg\
+  \ , stdev(objectCount) as comp_std by src_user, signature\n| eval upperBound=(comp_avg+comp_std)\
+  \ \n| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)\n\
+  | search isOutlier=1 | `windows_increase_in_group_or_object_modification_activity_filter`"
+how_to_implement: Run over past 7 days for best results. 
+known_false_positives: Genuine activity
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: Endpoint
+  confidence: 40
+  impact: 20
+  message: Spike in Group or Object Modifications performed by $src_user$
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 8
+  required_fields:
+  - EventCode
+  - src_user
+  - signature
+  security_domain: audit
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/application/windows_increase_in_user_modification_activity.yml

@@ -0,0 +1,55 @@
+name: Windows Increase in User Modification Activity
+id: 0995fca1-f346-432f-b0bf-a66d14e6b428
+version: 1
+date: '2023-10-13'
+author: Dean Luxton
+status: production
+type: TTP
+data_source:
+- XmlWinEventLog:Security
+description: Increase in user account modifications. 
+search: "`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)\
+  \ \n| bucket span=5m _time \n| stats values(TargetDomainName) as TargetDomainName,\
+  \ values(user) as user, dc(user) as userCount, values(user_category) as user_category,\
+  \ values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category)\
+  \ as dest_category by _time, src_user, signature, status\n| eventstats avg(userCount)\
+  \ as comp_avg , stdev(userCount) as comp_std by src_user, signature\n| eval upperBound=(comp_avg+comp_std*3)\
+  \ \n| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) \n| search\
+  \ isOutlier=1\n| stats values(TargetDomainName) as TargetDomainName, values(user)\
+  \ as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category)\
+  \ as src_user_category, values(dest) as dest, values(dest_category) as dest_category\
+  \ values(signature) as signature  by _time, src_user, status | `windows_increase_in_user_modification_activity_filter`"
+how_to_implement: Run over past 7 days for best results. 
+known_false_positives: Genuine activity
+references:
+- REFERENCE
+tags:
+  analytic_story:
+  - UPDATE_STORY_NAME
+  asset_type: Endpoint
+  confidence: 40
+  impact: 20
+  message: UPDATE message
+  mitre_attack_id:
+  - T1098
+  observable:
+  - name: src_user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 8
+  required_fields:
+  - EventCode
+  - src_user
+  - signature
+  security_domain: audit
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog

detections/network/internal_horizontal_port_scan.yml

@@ -0,0 +1,55 @@
+name: Internal Horizontal Port Scan
+id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1
+version: 1
+date: '2023-10-20'
+author: Dean Luxton
+status: production
+type: TTP
+data_source: []
+description: This analytic detects where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port / protocol.  
+search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action
+  values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as
+  dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic
+  where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip All_Traffic.dest_port
+  All_Traffic.dest_ip span=1s _time All_Traffic.transport | `drop_dm_object_name("All_Traffic")`
+  | eval gtime=_time | bin span=1h gtime | stats min(_time) as _time values(action)
+  as action dc(dest_ip) as totalDestIPCount values(src_category) as src_category values(dest_zone)
+  as dest_zone values(src_zone) as src_zone by src_ip dest_port gtime transport |
+  where totalDestIPCount>=250 | eval dest_port=transport + "/" + dest_port | stats
+  min(_time) as _time values(action) as action dc(totalDestIPCount) as totalDestIPCount
+  values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone)
+  as dest_zone values(src_zone) as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_filter`'
+how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model.
+known_false_positives: Unknown
+references: []
+tags:
+  analytic_story:
+  - Network Discovery
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: $src_ip$ has scanned for port $dest_port$ across $totalDestIPCount$ destination IPs
+  mitre_attack_id:
+  - T1046
+  observable:
+  - name: src_ip
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - _time
+  - All_Traffic.action
+  - All_Traffic.src_ip
+  - All_Traffic.dest_ip
+  - All_Traffic.dest_port
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log
+    sourcetype: aws:cloudwatchlogs:vpcflow

detections/network/internal_vertical_port_scan.yml

@@ -0,0 +1,57 @@
+name: Internal Vertical Port Scan
+id: 40d2dc41-9bbf-421a-a34b-8611271a6770
+version: 1
+date: '2023-10-20'
+author: Dean Luxton
+status: production
+type: TTP
+data_source: []
+description: This analytic detects an internal host has attempted to communicate with over 500 ports on a single destination IP. Additional filtering is performed on the number of privileged ports within the request to filter out applications performing port scans over ephemeral port ranges. 
+search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action
+  values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as
+  dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic
+  where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip
+  All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport span=1s _time |
+  `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | stats
+  min(_time) as _time values(action) as action dc(eval(if(dest_port<1024 AND transport="tcp",dest_port,null)))
+  as privilegedDestTcpPortCount dc(eval(if(transport="tcp",dest_port,null))) as totalDestTcpPortCount
+  dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null))) as privilegedDestUdpPortCount
+  dc(eval(if(transport="udp",dest_port,null))) as totalDestUdpPortCount values(src_category)
+  as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip
+  dest_ip transport gtime | eval totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount,
+  privilegedDestPortCount=privilegedDestTcpPortCount+privilegedDestUdpPortCount| where
+  (totalDestPortCount>=500 AND privilegedDestPortCount>=20) | fields - gtime | `internal_vertical_port_scan_filter`'
+how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model.
+known_false_positives: Unknown
+references: []
+tags:
+  analytic_story:
+  - Network Discovery
+  asset_type: Endpoint
+  confidence: 80
+  impact: 80
+  message: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$
+  mitre_attack_id:
+  - T1046
+  observable:
+  - name: src_ip
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 64
+  required_fields:
+  - _time
+  - All_Traffic.action
+  - All_Traffic.src_ip
+  - All_Traffic.dest_ip
+  - All_Traffic.dest_port
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log
+    sourcetype: aws:cloudwatchlogs:vpcflow