admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

new test file

Browse Source
This commit is contained in:
P4T12ICK
2020-11-06 13:26:45 +01:00
parent de839bc3b8
commit ee59a8150b
2 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+8 -9
View File
@@ -1,7 +1,7 @@
name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
id: c2590137-0b08-4985-9ec5-6ae23d92f63d
version: 5
date: '2020-07-21'
version: 6
date: '2020-11-06'
description: Monitor for changes of the ExecutionPolicy in the registry to the values
"unrestricted" or "bypass," which allows the execution of malicious scripts.
how_to_implement: You must be ingesting data that records process activity from your
@@ -11,13 +11,12 @@ how_to_implement: You must be ingesting data that records process activity from
type: ESCU
references: []
author: Patrick Bareiss, Splunk
search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
\ as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\\
\\Microsoft\\\\Powershell\\\\1\\\\ShellIds\\\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy\
\ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\
\ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\
\ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\
\ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_"
search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\\\Microsoft\\\\Powershell\\\\1\\\\ShellIds\\\\Microsoft.PowerShell*
Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)
by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
| `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`"
known_false_positives: Administrators may attempt to change the default execution
policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
or "bypass" as this search is designed to identify, would be unusual. Hits should
tests/endpoint/attempt_to_stop_security_service.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Attempt To Stop Security Service Unit Test
detections:
- name: Attempt To Stop Security Service
file: endpoint/attempt_to_stop_security_service.yml
pass_condition: '| stats count | where count > 0'
attack_data:
- file_name: windows-sysmon.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001_custom_f3b70c45-3f9f-493d-b0b0-6be2ad9f158b/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog