diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml new file mode 100644 index 0000000000..5abf80e9fe --- /dev/null +++ b/detections/application/windows_increase_in_group_or_object_modification_activity.yml @@ -0,0 +1,51 @@ +name: Windows Increase in Group or Object Modification Activity +id: 4f9564dd-a204-4f22-b375-4dfca3a68731 +version: 1 +date: '2023-10-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- XmlWinEventLog:Security +description: Increase in group or AD object modifications. +search: "`wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)\n| bucket\ + \ span=5m _time \n| stats values(object) as object, dc(object) as objectCount, values(src_user_category)\ + \ as src_user_category, values(dest) as dest, values(dest_category) as dest_category\ + \ by _time, src_user, signature, status\n| eventstats avg(objectCount) as comp_avg\ + \ , stdev(objectCount) as comp_std by src_user, signature\n| eval upperBound=(comp_avg+comp_std)\ + \ \n| eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)\n\ + | search isOutlier=1 | `windows_increase_in_group_or_object_modification_activity_filter`" +how_to_implement: Run over past 7 days for best results. +known_false_positives: Genuine activity +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 40 + impact: 20 + message: Spike in Group or Object Modifications performed by $src_user$ + mitre_attack_id: + - T1098 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 8 + required_fields: + - EventCode + - src_user + - signature + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml new file mode 100644 index 0000000000..6412cb04b1 --- /dev/null +++ b/detections/application/windows_increase_in_user_modification_activity.yml @@ -0,0 +1,55 @@ +name: Windows Increase in User Modification Activity +id: 0995fca1-f346-432f-b0bf-a66d14e6b428 +version: 1 +date: '2023-10-13' +author: Dean Luxton +status: production +type: TTP +data_source: +- XmlWinEventLog:Security +description: Increase in user account modifications. +search: "`wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)\ + \ \n| bucket span=5m _time \n| stats values(TargetDomainName) as TargetDomainName,\ + \ values(user) as user, dc(user) as userCount, values(user_category) as user_category,\ + \ values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category)\ + \ as dest_category by _time, src_user, signature, status\n| eventstats avg(userCount)\ + \ as comp_avg , stdev(userCount) as comp_std by src_user, signature\n| eval upperBound=(comp_avg+comp_std*3)\ + \ \n| eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) \n| search\ + \ isOutlier=1\n| stats values(TargetDomainName) as TargetDomainName, values(user)\ + \ as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category)\ + \ as src_user_category, values(dest) as dest, values(dest_category) as dest_category\ + \ values(signature) as signature by _time, src_user, status | `windows_increase_in_user_modification_activity_filter`" +how_to_implement: Run over past 7 days for best results. +known_false_positives: Genuine activity +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 40 + impact: 20 + message: UPDATE message + mitre_attack_id: + - T1098 + observable: + - name: src_user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 8 + required_fields: + - EventCode + - src_user + - signature + security_domain: audit +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/detections/network/internal_horizontal_port_scan.yml b/detections/network/internal_horizontal_port_scan.yml new file mode 100644 index 0000000000..3fcce56fc5 --- /dev/null +++ b/detections/network/internal_horizontal_port_scan.yml @@ -0,0 +1,55 @@ +name: Internal Horizontal Port Scan +id: 1ff9eb9a-7d72-4993-a55e-59a839e607f1 +version: 1 +date: '2023-10-20' +author: Dean Luxton +status: production +type: TTP +data_source: [] +description: This analytic detects where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port / protocol. +search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action + values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as + dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic + where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip All_Traffic.dest_port + All_Traffic.dest_ip span=1s _time All_Traffic.transport | `drop_dm_object_name("All_Traffic")` + | eval gtime=_time | bin span=1h gtime | stats min(_time) as _time values(action) + as action dc(dest_ip) as totalDestIPCount values(src_category) as src_category values(dest_zone) + as dest_zone values(src_zone) as src_zone by src_ip dest_port gtime transport | + where totalDestIPCount>=250 | eval dest_port=transport + "/" + dest_port | stats + min(_time) as _time values(action) as action dc(totalDestIPCount) as totalDestIPCount + values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone) + as dest_zone values(src_zone) as src_zone by src_ip gtime | fields - gtime | `internal_horizontal_port_scan_filter`' +how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model. +known_false_positives: Unknown +references: [] +tags: + analytic_story: + - Network Discovery + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $src_ip$ has scanned for port $dest_port$ across $totalDestIPCount$ destination IPs + mitre_attack_id: + - T1046 + observable: + - name: src_ip + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - All_Traffic.action + - All_Traffic.src_ip + - All_Traffic.dest_ip + - All_Traffic.dest_port + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/horizontal.log + sourcetype: aws:cloudwatchlogs:vpcflow diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml new file mode 100644 index 0000000000..bed28ec06f --- /dev/null +++ b/detections/network/internal_vertical_port_scan.yml @@ -0,0 +1,57 @@ +name: Internal Vertical Port Scan +id: 40d2dc41-9bbf-421a-a34b-8611271a6770 +version: 1 +date: '2023-10-20' +author: Dean Luxton +status: production +type: TTP +data_source: [] +description: This analytic detects an internal host has attempted to communicate with over 500 ports on a single destination IP. Additional filtering is performed on the number of privileged ports within the request to filter out applications performing port scans over ephemeral port ranges. +search: '| tstats `security_content_summariesonly` values(All_Traffic.action) as action + values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as + dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic + where All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.src_ip + All_Traffic.dest_port All_Traffic.dest_ip All_Traffic.transport span=1s _time | + `drop_dm_object_name("All_Traffic")` | eval gtime=_time | bin span=1h gtime | stats + min(_time) as _time values(action) as action dc(eval(if(dest_port<1024 AND transport="tcp",dest_port,null))) + as privilegedDestTcpPortCount dc(eval(if(transport="tcp",dest_port,null))) as totalDestTcpPortCount + dc(eval(if(dest_port<1024 AND transport="udp",dest_port,null))) as privilegedDestUdpPortCount + dc(eval(if(transport="udp",dest_port,null))) as totalDestUdpPortCount values(src_category) + as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip + dest_ip transport gtime | eval totalDestPortCount=totalDestUdpPortCount+totalDestTcpPortCount, + privilegedDestPortCount=privilegedDestTcpPortCount+privilegedDestUdpPortCount| where + (totalDestPortCount>=500 AND privilegedDestPortCount>=20) | fields - gtime | `internal_vertical_port_scan_filter`' +how_to_implement: You must ensure that your network traffic data is populating the Network_Traffic data model. +known_false_positives: Unknown +references: [] +tags: + analytic_story: + - Network Discovery + asset_type: Endpoint + confidence: 80 + impact: 80 + message: $src_ip$ has scanned $totalDestPortCount$ ports on $dest_ip$ + mitre_attack_id: + - T1046 + observable: + - name: src_ip + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 64 + required_fields: + - _time + - All_Traffic.action + - All_Traffic.src_ip + - All_Traffic.dest_ip + - All_Traffic.dest_port + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1046/nmap/vertical.log + sourcetype: aws:cloudwatchlogs:vpcflow