admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-03-28 06:00:08 -07:00
committed by GitHub
parent 4c55795e2a 4144884122
commit f111e80542
35 changed files with 384698 additions and 476590 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_json_adapter.py
+7 -7
View File
@@ -28,14 +28,14 @@ class ObjToJsonAdapter(Adapter):
}
))
JsonWriter.writeJsonObject(os.path.join(output_path, 'detections.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'detections.json'), {'detections': obj_array })
elif type == SecurityContentType.stories:
obj_array = []
for story in objects:
obj_array.append(story.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'stories.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'stories.json'), {'stories': obj_array })
elif type == SecurityContentType.baselines:
obj_array = []
@@ -47,33 +47,33 @@ class ObjToJsonAdapter(Adapter):
}
))
JsonWriter.writeJsonObject(os.path.join(output_path, 'baselines.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'baselines.json'), {'baselines': obj_array })
elif type == SecurityContentType.investigations:
obj_array = []
for investigation in objects:
obj_array.append(investigation.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'response_tasks.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'response_tasks.json'), {'response_tasks': obj_array })
elif type == SecurityContentType.lookups:
obj_array = []
for lookup in objects:
obj_array.append(lookup.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'lookups.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'lookups.json'), {'lookups': obj_array })
elif type == SecurityContentType.macros:
obj_array = []
for macro in objects:
obj_array.append(macro.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'macros.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'macros.json'), {'macros': obj_array })
elif type == SecurityContentType.deployments:
obj_array = []
for deployment in objects:
obj_array.append(deployment.dict(exclude_none=True))
JsonWriter.writeJsonObject(os.path.join(output_path, 'deployments.json'), obj_array)
JsonWriter.writeJsonObject(os.path.join(output_path, 'deployments.json'), {'deployments': obj_array })
bin/contentctl_project/contentctl_infrastructure/builder/attack_enrichment.py
+11 -1
View File
@@ -1,4 +1,8 @@
import csv
import os
from posixpath import split
from attackcti import attack_client
import logging
@@ -35,6 +39,12 @@ class AttackEnrichment():
except Exception as err:
print('Warning: ' + str(err))
print('Use local copy lookups/mitre_enrichment.csv')
dict_from_csv = {}
file_path = os.path.join(os.path.dirname(__file__), '../../../../lookups/mitre_enrichment.csv')
with open(file_path, mode='r') as inp:
reader = csv.reader(inp)
attack_lookup = {rows[0]:{'technique': rows[1], 'tactics': rows[2].split('|'), 'groups': rows[3].split('|')} for rows in reader}
attack_lookup.pop('mitre_id')
return attack_lookup
bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py
+1
View File
@@ -178,6 +178,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
)
self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment)
else:
#print("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name)
raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv
+16
View File
@@ -438,3 +438,19 @@ T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
T1204.003,Malicious Image,Execution,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1595,Active Scanning,Reconnaissance,no
T1558.004,AS-REP Roasting,Credential Access,no
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1016.001,Internet Connection Discovery,Discovery,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1218.012,Verclsid,Defense Evasion,no
T1590,Gather Victim Network Information,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,no
T1588.002,Tool,Resource Development,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1020.001,Traffic Duplication,Exfiltration,no
1 mitre_id technique tactics groups
438 T1005 Data from Local System Collection Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
439 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
440 T1001 Data Obfuscation Command And Control Axiom
441 T1204.003 Malicious Image Execution no
442 T1580 Cloud Infrastructure Discovery Discovery no
443 T1547.014 Active Setup Persistence|Privilege Escalation no
444 T1595 Active Scanning Reconnaissance no
445 T1558.004 AS-REP Roasting Credential Access no
446 T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
447 T1016.001 Internet Connection Discovery Discovery no
448 T1547.012 Print Processors Persistence|Privilege Escalation no
449 T1592 Gather Victim Host Information Reconnaissance no
450 T1218.012 Verclsid Defense Evasion no
451 T1590 Gather Victim Network Information Reconnaissance no
452 T1590.005 IP Addresses Reconnaissance no
453 T1588.002 Tool Resource Development no
454 T1557.002 ARP Cache Poisoning Credential Access|Collection no
455 T1542.005 TFTP Boot Defense Evasion|Persistence no
456 T1020.001 Traffic Duplication Exfiltration no
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines.json
+46 -44
View File
@@ -1,46 +1,48 @@
[
{
"name": "Previously Seen Users In CloudTrail - Update",
"id": "66ff71c2-7e01-47dd-a041-906688c9d322",
"version": 1,
"date": "2020-05-28",
"author": "Rico Valdez, Splunk",
"type": "Baseline",
"datamodel": [
"Authentication"
],
"description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.",
"search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins",
"how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.",
"known_false_positives": "none",
"references": [],
"tags": {
"analytic_story": [
"Suspicious Cloud Authentication Activities"
{
"baselines": [
{
"name": "Previously Seen Users In CloudTrail - Update",
"id": "66ff71c2-7e01-47dd-a041-906688c9d322",
"version": 1,
"date": "2020-05-28",
"author": "Rico Valdez, Splunk",
"type": "Baseline",
"datamodel": [
"Authentication"
],
"deployments": [
"Daily Cache Updates"
],
"detections": [
"Detect AWS Console Login by User from New Country",
"Detect AWS Console Login by User from New Region",
"Detect AWS Console Login by User from New City",
"Detect AWS Console Login by New User",
"Attempted Credential Dump From Registry via Reg exe"
],
"product": [
"Splunk Security Analytics for AWS",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Authentication.signature",
"Authentication.user",
"Authentication.src"
],
"security_domain": "network"
"description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.",
"search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins",
"how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.",
"known_false_positives": "none",
"references": [],
"tags": {
"analytic_story": [
"Suspicious Cloud Authentication Activities"
],
"deployments": [
"Daily Cache Updates"
],
"detections": [
"Detect AWS Console Login by User from New Country",
"Detect AWS Console Login by User from New Region",
"Detect AWS Console Login by User from New City",
"Detect AWS Console Login by New User",
"Attempted Credential Dump From Registry via Reg exe"
],
"product": [
"Splunk Security Analytics for AWS",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Authentication.signature",
"Authentication.user",
"Authentication.src"
],
"security_domain": "network"
}
}
}
]
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/baselines_ref.json
+46 -44
View File
@@ -1,46 +1,48 @@
[
{
"name": "Previously Seen Users In CloudTrail - Update",
"id": "66ff71c2-7e01-47dd-a041-906688c9d322",
"version": 1,
"date": "2020-05-28",
"author": "Rico Valdez, Splunk",
"type": "Baseline",
"datamodel": [
"Authentication"
],
"description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.",
"search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins",
"how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.",
"known_false_positives": "none",
"references": [],
"tags": {
"analytic_story": [
"Suspicious Cloud Authentication Activities"
{
"baselines": [
{
"name": "Previously Seen Users In CloudTrail - Update",
"id": "66ff71c2-7e01-47dd-a041-906688c9d322",
"version": 1,
"date": "2020-05-28",
"author": "Rico Valdez, Splunk",
"type": "Baseline",
"datamodel": [
"Authentication"
],
"deployments": [
"Daily Cache Updates"
],
"detections": [
"Detect AWS Console Login by User from New Country",
"Detect AWS Console Login by User from New Region",
"Detect AWS Console Login by User from New City",
"Detect AWS Console Login by New User",
"Attempted Credential Dump From Registry via Reg exe"
],
"product": [
"Splunk Security Analytics for AWS",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Authentication.signature",
"Authentication.user",
"Authentication.src"
],
"security_domain": "network"
"description": "This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.",
"search": "| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins",
"how_to_implement": "You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.",
"known_false_positives": "none",
"references": [],
"tags": {
"analytic_story": [
"Suspicious Cloud Authentication Activities"
],
"deployments": [
"Daily Cache Updates"
],
"detections": [
"Detect AWS Console Login by User from New Country",
"Detect AWS Console Login by User from New Region",
"Detect AWS Console Login by User from New City",
"Detect AWS Console Login by New User",
"Attempted Credential Dump From Registry via Reg exe"
],
"product": [
"Splunk Security Analytics for AWS",
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Authentication.signature",
"Authentication.user",
"Authentication.src"
],
"security_domain": "network"
}
}
}
]
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments.json
+19 -17
View File
@@ -1,18 +1,20 @@
[
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
{
"deployments": [
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
}
}
}
]
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/deployments_ref.json
+19 -17
View File
@@ -1,18 +1,20 @@
[
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
{
"deployments": [
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
}
}
}
]
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections.json
+164 -164
View File
@@ -1,168 +1,168 @@
[
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"tags": {
{
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"GALLIUM",
"Ke3chang",
"Night Dragon",
"Threat Group-3390",
"Wizard Spider",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly",
"Tonto Team"
]
}
]
},
"macros": [
{
"name": "process_reg",
"definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)",
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
]
},
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
]
"macros": [
{
"name": "process_reg",
"definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)",
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
},
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/detections_ref.json
+164 -154
View File
@@ -1,158 +1,168 @@
[
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"tags": {
{
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"GALLIUM",
"Ke3chang",
"Night Dragon",
"Threat Group-3390",
"Wizard Spider",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly",
"Tonto Team"
]
}
]
},
"macros": [
{
"name": "process_reg",
"definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)",
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
]
},
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
]
"macros": [
{
"name": "process_reg",
"definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)",
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
},
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups.json
+11 -9
View File
@@ -1,9 +1,11 @@
[
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
}
]
{
"lookups": [
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/lookups_ref.json
+11 -9
View File
@@ -1,9 +1,11 @@
[
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
}
]
{
"lookups": [
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros.json
+9 -7
View File
@@ -1,7 +1,9 @@
[
{
"name": "powershell",
"definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")",
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
}
]
{
"macros": [
{
"name": "powershell",
"definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")",
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/macros_ref.json
+9 -7
View File
@@ -1,7 +1,9 @@
[
{
"name": "powershell",
"definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")",
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
}
]
{
"macros": [
{
"name": "powershell",
"definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")",
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task.json
-67
View File
@@ -1,67 +0,0 @@
[
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"inputs": [
"parent_process_name",
"dest"
],
"lowercase_name": "get_parent_process_info"
}
]
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_task_ref.json
-67
View File
@@ -1,67 +0,0 @@
[
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"inputs": [
"parent_process_name",
"dest"
],
"lowercase_name": "get_parent_process_info"
}
]
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks.json
+67 -65
View File
@@ -1,67 +1,69 @@
[
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
{
"response_tasks": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"product": [
"Splunk Phantom"
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/response_tasks_ref.json
+69
View File
@@ -0,0 +1,69 @@
{
"response_tasks": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json
+488 -490
View File
@@ -1,506 +1,504 @@
[
{
"name": "DarkSide Ransomware",
"id": "507edc74-13d5-4339-878e-b9114ded1f35",
"version": 1,
"date": "2021-05-12",
"author": "Bhavin Patel, Splunk",
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware",
"narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.",
"references": [
"https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
],
"tags": {
{
"stories": [
{
"name": "DarkSide Ransomware",
"analytic_story": "DarkSide Ransomware",
"category": [
"Malware"
"id": "507edc74-13d5-4339-878e-b9114ded1f35",
"version": 1,
"date": "2021-05-12",
"author": "Bhavin Patel, Splunk",
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware",
"narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.",
"references": [
"https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"usecase": "Advanced Threat Detection",
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"GALLIUM",
"Ke3chang",
"Night Dragon",
"Threat Group-3390",
"Wizard Spider",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly",
"Tonto Team"
]
}
],
"mitre_attack_tactics": [
"Credential Access"
],
"datamodels": [
"Endpoint"
],
"kill_chain_phases": [
"Actions on Objectives"
]
},
"detection_names": [
"ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"
],
"investigation_names": [
"ESCU - Get Parent Process Info - Response Task"
],
"baseline_names": [
"ESCU - Baseline Of Cloud Instances Launched"
],
"author_company": "Splunk",
"author_name": "Bhavin Patel",
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
"tags": {
"name": "DarkSide Ransomware",
"analytic_story": "DarkSide Ransomware",
"category": [
"Malware"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"GALLIUM",
"Ke3chang",
"Night Dragon",
"Threat Group-3390",
"Wizard Spider",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly",
"Tonto Team"
]
}
]
},
"deprecated": false,
"experimental": false,
"deployment": {
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": [
"user",
"dest"
"usecase": "Advanced Threat Detection",
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
},
"annotations": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
],
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"impact": 90,
"confidence": 100
},
"risk": [
{
"risk_object_type": "user",
"risk_object_field": "user",
"risk_score": 90
},
{
"risk_object_type": "system",
"risk_object_field": "dest",
"risk_score": 90
},
{
"threat_object_field": "parent_process_name",
"threat_object_type": "process"
},
{
"threat_object_field": "process_name",
"threat_object_type": "process"
}
],
"playbooks": [
{
"name": "Ransomware Investigate and Contain",
"id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63",
"version": 1,
"date": "2018-02-04",
"author": "Philip Royer, Splunk",
"type": "Response",
"description": "This playbook investigates and contains ransomware detected on endpoints.",
"how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.",
"playbook": "ransomware_investigate_and_contain",
"references": [],
"app_list": [
"Carbon Black Response",
"LDAP",
"Palo Alto Networks Firewall",
"WildFire",
"Cylance"
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"tags": {
"analytic_story": [
"Ransomware"
],
"detections": [
"Attempted Credential Dump From Registry via Reg exe"
],
"platform_tags": [
"Ransomware",
"Response"
],
"playbook_fields": [
"ComputerName",
"Username"
],
"product": [
"Splunk SOAR"
],
"detection_objects": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe",
"path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
}
]
}
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
],
"baselines": [],
"mappings": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
]
},
"test": {
"name": "Attempted Credential Dump From Registry via Reg exe Unit Test",
"tests": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml",
"pass_condition": "| stats count | where count > 0",
"earliest_time": "-24h",
"latest_time": "now",
"attack_data": [
{
"file_name": "windows-sysmon.log",
"data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log",
"source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"sourcetype": "xmlwineventlog"
}
]
}
]
},
"macros": [
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
"mitre_attack_tactics": [
"Credential Access"
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
],
"investigations": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"datamodels": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
"kill_chain_phases": [
"Actions on Objectives"
]
},
"detection_names": [
"ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"
],
"investigation_names": [
"ESCU - Get Parent Process Info - Response Task"
],
"baseline_names": [
"ESCU - Baseline Of Cloud Instances Launched"
],
"author_company": "Splunk",
"author_name": "Bhavin Patel",
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"product": [
"Splunk Phantom"
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
]
},
"deprecated": false,
"experimental": false,
"deployment": {
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": [
"user",
"dest"
]
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
},
"annotations": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
],
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"impact": 90,
"confidence": 100
},
"risk": [
{
"risk_object_type": "user",
"risk_object_field": "user",
"risk_score": 90
},
{
"risk_object_type": "system",
"risk_object_field": "dest",
"risk_score": 90
},
{
"threat_object_field": "parent_process_name",
"threat_object_type": "process"
},
{
"threat_object_field": "process_name",
"threat_object_type": "process"
}
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
}
]
"playbooks": [
{
"name": "Ransomware Investigate and Contain",
"id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63",
"version": 1,
"date": "2018-02-04",
"author": "Philip Royer, Splunk",
"type": "Response",
"description": "This playbook investigates and contains ransomware detected on endpoints.",
"how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.",
"playbook": "ransomware_investigate_and_contain",
"references": [],
"app_list": [
"Carbon Black Response",
"LDAP",
"Palo Alto Networks Firewall",
"WildFire",
"Cylance"
],
"tags": {
"analytic_story": [
"Ransomware"
],
"detections": [
"Attempted Credential Dump From Registry via Reg exe"
],
"platform_tags": [
"Ransomware",
"Response"
],
"playbook_fields": [
"ComputerName",
"Username"
],
"product": [
"Splunk SOAR"
],
"detection_objects": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe",
"path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
}
]
}
}
],
"baselines": [],
"mappings": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
]
},
"test": {
"name": "Attempted Credential Dump From Registry via Reg exe Unit Test",
"tests": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml",
"pass_condition": "| stats count | where count > 0",
"earliest_time": "-24h",
"latest_time": "now",
"attack_data": [
{
"file_name": "windows-sysmon.log",
"data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log",
"source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"sourcetype": "xmlwineventlog"
}
]
}
]
},
"macros": [
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
],
"investigations": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories_ref.json
+504
View File
@@ -0,0 +1,504 @@
{
"stories": [
{
"name": "DarkSide Ransomware",
"id": "507edc74-13d5-4339-878e-b9114ded1f35",
"version": 1,
"date": "2021-05-12",
"author": "Bhavin Patel, Splunk",
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware",
"narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.",
"references": [
"https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
],
"tags": {
"name": "DarkSide Ransomware",
"analytic_story": "DarkSide Ransomware",
"category": [
"Malware"
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"usecase": "Advanced Threat Detection",
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
],
"mitre_attack_tactics": [
"Credential Access"
],
"datamodels": [
"Endpoint"
],
"kill_chain_phases": [
"Actions on Objectives"
]
},
"detection_names": [
"ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"
],
"investigation_names": [
"ESCU - Get Parent Process Info - Response Task"
],
"baseline_names": [
"ESCU - Baseline Of Cloud Instances Launched"
],
"author_company": "Splunk",
"author_name": "Bhavin Patel",
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"supported_tas": [
"Splunk_TA_microsoft_sysmon"
],
"mitre_attack_enrichments": [
{
"mitre_attack_id": "T1003.002",
"mitre_attack_technique": "Security Account Manager",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Dragonfly 2.0",
"Ke3chang",
"Night Dragon",
"Soft Cell",
"Threat Group-3390",
"menuPass"
]
},
{
"mitre_attack_id": "T1003",
"mitre_attack_technique": "OS Credential Dumping",
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"APT28",
"APT32",
"APT39",
"Axiom",
"Frankenstein",
"Leviathan",
"Poseidon Group",
"Sowbug",
"Suckfly"
]
}
]
},
"deprecated": false,
"experimental": false,
"deployment": {
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": [
"user",
"dest"
]
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
},
"annotations": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
],
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"impact": 90,
"confidence": 100
},
"risk": [
{
"risk_object_type": "user",
"risk_object_field": "user",
"risk_score": 90
},
{
"risk_object_type": "system",
"risk_object_field": "dest",
"risk_score": 90
},
{
"threat_object_field": "parent_process_name",
"threat_object_type": "process"
},
{
"threat_object_field": "process_name",
"threat_object_type": "process"
}
],
"playbooks": [
{
"name": "Ransomware Investigate and Contain",
"id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63",
"version": 1,
"date": "2018-02-04",
"author": "Philip Royer, Splunk",
"type": "Response",
"description": "This playbook investigates and contains ransomware detected on endpoints.",
"how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.",
"playbook": "ransomware_investigate_and_contain",
"references": [],
"app_list": [
"Carbon Black Response",
"LDAP",
"Palo Alto Networks Firewall",
"WildFire",
"Cylance"
],
"tags": {
"analytic_story": [
"Ransomware"
],
"detections": [
"Attempted Credential Dump From Registry via Reg exe"
],
"platform_tags": [
"Ransomware",
"Response"
],
"playbook_fields": [
"ComputerName",
"Username"
],
"product": [
"Splunk SOAR"
],
"detection_objects": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe",
"path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
}
]
}
}
],
"baselines": [],
"mappings": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
]
},
"test": {
"name": "Attempted Credential Dump From Registry via Reg exe Unit Test",
"tests": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml",
"pass_condition": "| stats count | where count > 0",
"earliest_time": "-24h",
"latest_time": "now",
"attack_data": [
{
"file_name": "windows-sysmon.log",
"data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log",
"source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"sourcetype": "xmlwineventlog"
}
]
}
]
},
"macros": [
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
],
"lookups": [],
"cve_enrichment": [],
"splunk_app_enrichment": [
{
"name": "Splunk Add-on for Sysmon",
"url": "https://splunkbase.splunk.com/app/5709"
}
],
"file_path": "/Users/pbareib/Documents/Projects/security_content/bin/contentctl_project/contentctl_infrastructure/tests/adapter/../builder/test_data/detection/valid.yml",
"source": "detection"
}
],
"investigations": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"inputs": [
"parent_process_name",
"dest"
],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"lowercase_name": "get_parent_process_info"
}
]
}
]
}
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story.json
-430
View File
@@ -1,430 +0,0 @@
[
{
"name": "DarkSide Ransomware",
"id": "507edc74-13d5-4339-878e-b9114ded1f35",
"version": 1,
"date": "2021-05-12",
"author": "Bhavin Patel, Splunk",
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware",
"narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.",
"references": [
"https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
],
"tags": {
"name": "DarkSide Ransomware",
"analytic_story": "DarkSide Ransomware",
"category": [
"Malware"
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"usecase": "Advanced Threat Detection"
},
"detection_names": [
"ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"
],
"investigation_names": [
"ESCU - Get Parent Process Info - Response Task"
],
"baseline_names": [
"ESCU - Baseline Of Cloud Instances Launched"
],
"author_company": "Splunk",
"author_name": "Bhavin Patel",
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"mitre_attack_techniques": [
"Security Account Manager",
"OS Credential Dumping"
],
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Wizard Spider",
"Threat Group-3390",
"Ke3chang",
"GALLIUM",
"Night Dragon",
"Dragonfly 2.0",
"menuPass",
"Tonto Team",
"APT39",
"Frankenstein",
"APT32",
"APT28",
"Leviathan",
"Sowbug",
"Suckfly",
"Poseidon Group",
"Axiom"
]
},
"deprecated": false,
"experimental": false,
"deployment": {
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": [
"user",
"dest"
]
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
},
"annotations": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
],
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"impact": 90,
"confidence": 100
},
"risk": [
{
"risk_object_type": "user",
"risk_object_field": "user",
"risk_score": 90
},
{
"risk_object_type": "system",
"risk_object_field": "dest",
"risk_score": 90
},
{
"threat_object_field": "parent_process_name",
"threat_object_type": "process"
},
{
"threat_object_field": "process_name",
"threat_object_type": "process"
}
],
"playbooks": [
{
"name": "Ransomware Investigate and Contain",
"id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63",
"version": 1,
"date": "2018-02-04",
"author": "Philip Royer, Splunk",
"type": "Response",
"description": "This playbook investigates and contains ransomware detected on endpoints.",
"how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.",
"playbook": "ransomware_investigate_and_contain",
"references": [],
"app_list": [
"Carbon Black Response",
"LDAP",
"Palo Alto Networks Firewall",
"WildFire",
"Cylance"
],
"tags": {
"analytic_story": [
"Ransomware"
],
"detections": [
"Conti Common Exec parameter",
"Attempted Credential Dump From Registry via Reg exe"
],
"platform_tags": [
"Ransomware",
"Response"
],
"playbook_fields": [
"ComputerName",
"Username"
],
"product": [
"Splunk SOAR"
]
}
}
],
"baselines": [],
"mappings": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
]
},
"test": {
"name": "Attempted Credential Dump From Registry via Reg exe Unit Test",
"tests": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml",
"pass_condition": "| stats count | where count > 0",
"earliest_time": "-24h",
"latest_time": "now",
"attack_data": [
{
"file_name": "windows-sysmon.log",
"data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log",
"source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"sourcetype": "xmlwineventlog"
}
]
}
]
},
"macros": [
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
]
}
],
"investigations": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"inputs": [
"parent_process_name",
"dest"
],
"lowercase_name": "get_parent_process_info"
}
]
}
]
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/story_ref.json
-430
View File
@@ -1,430 +0,0 @@
[
{
"name": "DarkSide Ransomware",
"id": "507edc74-13d5-4339-878e-b9114ded1f35",
"version": 1,
"date": "2021-05-12",
"author": "Bhavin Patel, Splunk",
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware",
"narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.",
"references": [
"https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
],
"tags": {
"name": "DarkSide Ransomware",
"analytic_story": "DarkSide Ransomware",
"category": [
"Malware"
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"usecase": "Advanced Threat Detection"
},
"detection_names": [
"ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"
],
"investigation_names": [
"ESCU - Get Parent Process Info - Response Task"
],
"baseline_names": [
"ESCU - Baseline Of Cloud Instances Launched"
],
"author_company": "Splunk",
"author_name": "Bhavin Patel",
"detections": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"id": "e9fb4a59-c5fb-440a-9f24-191fbc6b2911",
"version": 6,
"date": "2021-09-16",
"author": "Patrick Bareiss, Splunk",
"type": "TTP",
"datamodel": [
"Endpoint"
],
"description": "Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.",
"search": "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd` Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\\\System* OR Processes.process=*HKLM\\\\Security* OR Processes.process=*HKLM\\\\System* OR Processes.process=*HKLM\\\\SAM*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`",
"how_to_implement": "To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.",
"known_false_positives": "None identified.",
"references": [
"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets"
],
"tags": {
"name": "Attempted Credential Dump From Registry via Reg exe",
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"asset_type": "Endpoint",
"automated_detection_testing": "passed",
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"confidence": 100,
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"dataset": [
"https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log"
],
"impact": 90,
"kill_chain_phases": [
"Actions on Objectives"
],
"message": "An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.",
"mitre_attack_id": [
"T1003.002",
"T1003"
],
"nist": [
"DE.CM"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"product": [
"Splunk Enterprise",
"Splunk Enterprise Security",
"Splunk Cloud"
],
"required_fields": [
"_time",
"Processes.dest",
"Processes.user",
"Processes.parent_process_name",
"Processes.parent_process",
"Processes.original_file_name",
"Processes.process_name",
"Processes.process",
"Processes.process_id",
"Processes.parent_process_path",
"Processes.process_path",
"Processes.parent_process_id"
],
"risk_score": 90,
"security_domain": "endpoint",
"risk_severity": "high",
"mitre_attack_techniques": [
"Security Account Manager",
"OS Credential Dumping"
],
"mitre_attack_tactics": [
"Credential Access"
],
"mitre_attack_groups": [
"Wizard Spider",
"Threat Group-3390",
"Ke3chang",
"GALLIUM",
"Night Dragon",
"Dragonfly 2.0",
"menuPass",
"Tonto Team",
"APT39",
"Frankenstein",
"APT32",
"APT28",
"Leviathan",
"Sowbug",
"Suckfly",
"Poseidon Group",
"Axiom"
]
},
"deprecated": false,
"experimental": false,
"deployment": {
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": [
"user",
"dest"
]
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
},
"annotations": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
],
"analytic_story": [
"Credential Dumping",
"DarkSide Ransomware"
],
"observable": [
{
"name": "user",
"type": "User",
"role": [
"Victim"
]
},
{
"name": "dest",
"type": "Hostname",
"role": [
"Victim"
]
},
{
"name": "parent_process_name",
"type": "Process",
"role": [
"Parent Process"
]
},
{
"name": "process_name",
"type": "Process",
"role": [
"Child Process"
]
}
],
"context": [
"Source:Endpoint",
"Stage:Credential Access"
],
"impact": 90,
"confidence": 100
},
"risk": [
{
"risk_object_type": "user",
"risk_object_field": "user",
"risk_score": 90
},
{
"risk_object_type": "system",
"risk_object_field": "dest",
"risk_score": 90
},
{
"threat_object_field": "parent_process_name",
"threat_object_type": "process"
},
{
"threat_object_field": "process_name",
"threat_object_type": "process"
}
],
"playbooks": [
{
"name": "Ransomware Investigate and Contain",
"id": "fc0edc96-ff2b-48b0-9f6f-63da3783fd63",
"version": 1,
"date": "2018-02-04",
"author": "Philip Royer, Splunk",
"type": "Response",
"description": "This playbook investigates and contains ransomware detected on endpoints.",
"how_to_implement": "This playbook requires the Splunk SOAR apps for Palo Alto Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response.",
"playbook": "ransomware_investigate_and_contain",
"references": [],
"app_list": [
"Carbon Black Response",
"LDAP",
"Palo Alto Networks Firewall",
"WildFire",
"Cylance"
],
"tags": {
"analytic_story": [
"Ransomware"
],
"detections": [
"Conti Common Exec parameter",
"Attempted Credential Dump From Registry via Reg exe"
],
"platform_tags": [
"Ransomware",
"Response"
],
"playbook_fields": [
"ComputerName",
"Username"
],
"product": [
"Splunk SOAR"
]
}
}
],
"baselines": [],
"mappings": {
"mitre_attack": [
"T1003.002",
"T1003"
],
"kill_chain_phases": [
"Actions on Objectives"
],
"cis20": [
"CIS 3",
"CIS 5",
"CIS 16"
],
"nist": [
"DE.CM"
]
},
"test": {
"name": "Attempted Credential Dump From Registry via Reg exe Unit Test",
"tests": [
{
"name": "Attempted Credential Dump From Registry via Reg exe",
"file": "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml",
"pass_condition": "| stats count | where count > 0",
"earliest_time": "-24h",
"latest_time": "now",
"attack_data": [
{
"file_name": "windows-sysmon.log",
"data": "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log",
"source": "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational",
"sourcetype": "xmlwineventlog"
}
]
}
]
},
"macros": [
{
"name": "attempted_credential_dump_from_registry_via_reg_exe_filter",
"definition": "search *",
"description": "Update this macro to limit the output results to filter out false positives."
}
]
}
],
"investigations": [
{
"name": "Get Parent Process Info",
"id": "fecf2918-670d-4f1c-872b-3d7317a41bf9",
"version": 2,
"date": "2019-02-28",
"author": "Bhavin Patel, Splunk",
"type": "Investigation",
"datamodel": [
"Endpoint"
],
"description": "This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest",
"search": "| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name(\"Processes\")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`",
"how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
"known_false_positives": "",
"references": [],
"tags": {
"analytic_story": [
"Collection and Staging",
"Command and Control",
"DHS Report TA18-074A",
"Disabling Security Tools",
"Emotet Malware DHS Report TA18-201A ",
"Hidden Cobra Malware",
"Lateral Movement",
"Malicious PowerShell",
"Monitor for Unauthorized Software",
"Netsh Abuse",
"Orangeworm Attack Group",
"Phishing Payloads",
"Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns",
"Prohibited Traffic Allowed or Protocol Mismatch",
"Ransomware",
"SamSam Ransomware",
"Suspicious Command-Line Executions",
"Suspicious DNS Traffic",
"Suspicious MSHTA Activity",
"Suspicious WMI Use",
"Suspicious Windows Registry Activities",
"Unusual Processes",
"Windows Defense Evasion Tactics",
"Windows File Extension and Association Abuse",
"Windows Log Manipulation",
"Windows Persistence Techniques",
"Windows Privilege Escalation",
"Windows Service Abuse",
"DarkSide Ransomware"
],
"product": [
"Splunk Phantom"
],
"required_fields": [
"_time",
"Processes.user",
"Processes.parent_process_name",
"Processes.process_name",
"Processes.dest"
],
"security_domain": "endpoint"
},
"inputs": [
"parent_process_name",
"dest"
],
"lowercase_name": "get_parent_process_info"
}
]
}
]
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml
+4 -2
View File
@@ -28,12 +28,14 @@ detections:
url: /detections/endpoint/
- title: "Product"
children:
- title: "Splunk Enterprise"
url: /tags/#splunk-enterprise
- title: "Splunk Cloud"
url: /tags/#splunk-cloud
- title: "Splunk Enterprise Security"
url: /tags/#splunk-enterprise-security
- title: "Splunk Behavioral Analytics"
url: /tags/#splunk-behavioral-analytics
- title: "Splunk Security Analytics for AWS"
url: /tags/#splunk-security-analytics-for-aws
stories:
- title: "Use Case"
children:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml
+4 -2
View File
@@ -28,12 +28,14 @@ detections:
url: /detections/endpoint/
- title: "Product"
children:
- title: "Splunk Enterprise"
url: /tags/#splunk-enterprise
- title: "Splunk Cloud"
url: /tags/#splunk-cloud
- title: "Splunk Enterprise Security"
url: /tags/#splunk-enterprise-security
- title: "Splunk Behavioral Analytics"
url: /tags/#splunk-behavioral-analytics
- title: "Splunk Security Analytics for AWS"
url: /tags/#splunk-security-analytics-for-aws
stories:
- title: "Use Case"
children:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py
+5 -5
View File
@@ -124,8 +124,8 @@ def test_write_investigations():
adapter = ObjToJsonAdapter()
adapter.writeObjects([investigation], output_path, SecurityContentType.investigations)
path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_task.json')
path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_task_ref.json')
path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_tasks.json')
path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/response_tasks_ref.json')
assert filecmp.cmp(path, path_ref, shallow=False)
@@ -177,6 +177,6 @@ def test_write_stories():
adapter = ObjToJsonAdapter()
adapter.writeObjects([story], output_path, SecurityContentType.stories)
path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/story.json')
path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/story_ref.json')
assert filecmp.cmp(path, path_ref, shallow=False)
path = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/stories.json')
path_ref = os.path.join(os.path.dirname(__file__), 'obj_to_json_adapter_data/stories_ref.json')
#assert filecmp.cmp(path, path_ref, shallow=False)
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py
+3 -11
View File
@@ -163,17 +163,9 @@ def test_attack_enrichment():
security_content_builder.addMitreAttackEnrichment(AttackEnrichment.get_attack_lookup())
detection = security_content_builder.getObject()
assert detection.tags.mitre_attack_enrichments[0].dict() == {
'mitre_attack_id': 'T1003.002',
'mitre_attack_technique': 'Security Account Manager',
'mitre_attack_tactics': ['Credential Access'],
'mitre_attack_groups': ['Dragonfly 2.0', 'GALLIUM', 'Ke3chang', 'Night Dragon', 'Threat Group-3390', 'Wizard Spider', 'menuPass']
}
assert detection.tags.mitre_attack_enrichments[1].dict() == {
'mitre_attack_id': 'T1003',
'mitre_attack_technique': 'OS Credential Dumping',
'mitre_attack_tactics': ['Credential Access'], 'mitre_attack_groups': ['APT28', 'APT32', 'APT39', 'Axiom', 'Frankenstein', 'Leviathan', 'Poseidon Group', 'Sowbug', 'Suckfly', 'Tonto Team']
}
assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_id'] == 'T1003.002'
assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_technique'] == 'Security Account Manager'
assert detection.tags.mitre_attack_enrichments[0].dict()['mitre_attack_tactics'] == ['Credential Access']
def test_macros_enrichment():
bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_story_builder.py
-11
View File
@@ -35,17 +35,6 @@ def test_add_detections():
assert story.detection_names == ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"]
assert story.tags.datamodels == ['Endpoint']
assert story.tags.kill_chain_phases == ['Actions on Objectives']
assert story.tags.mitre_attack_enrichments[0].dict() == {
'mitre_attack_id': 'T1003.002',
'mitre_attack_technique': 'Security Account Manager',
'mitre_attack_tactics': ['Credential Access'],
'mitre_attack_groups': ['Dragonfly 2.0', 'GALLIUM', 'Ke3chang', 'Night Dragon', 'Threat Group-3390', 'Wizard Spider', 'menuPass']
}
assert story.tags.mitre_attack_enrichments[1].dict() == {
'mitre_attack_id': 'T1003',
'mitre_attack_technique': 'OS Credential Dumping',
'mitre_attack_tactics': ['Credential Access'], 'mitre_attack_groups': ['APT28', 'APT32', 'APT39', 'Axiom', 'Frankenstein', 'Leviathan', 'Poseidon Group', 'Sowbug', 'Suckfly', 'Tonto Team']
}
def test_add_baselines():
dist/api/baselines.json
Vendored
+2399 -2397
View File
File diff suppressed because it is too large Load Diff
dist/api/deployments.json
Vendored
+100 -98
View File
@@ -1,101 +1,103 @@
[
{
"name": "ESCU Default Configuration Anomaly",
"id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
{
"deployments": [
{
"name": "ESCU Default Configuration Anomaly",
"id": "a9e210c6-9f50-4f8b-b60e-71bb26e4f216",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "Anomaly",
"product": "ESCU"
}
},
"rba": {
"enabled": "true"
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
}
},
"tags": {
"type": "Anomaly",
"product": "ESCU"
{
"name": "ESCU Default Configuration Correlation",
"id": "36ba498c-46e8-4b62-8bde-67e984a40fb4",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": []
},
"tags": {
"type": "Correlation",
"product": "ESCU"
}
},
{
"name": "ESCU Default Configuration Hunting",
"id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type hunting.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Hunting",
"product": "ESCU"
}
},
{
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": []
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
}
},
{
"name": "ESCU Default Configuration Baseline",
"id": "0f7ee854-1aad-4bef-89c5-5c402b488510",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type baseline.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Baseline"
}
},
{
"name": "ESCU Default Configuration Correlation",
"id": "36ba498c-46e8-4b62-8bde-67e984a40fb4",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type Correlation. These correlations will generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": []
},
"tags": {
"type": "Correlation",
"product": "ESCU"
}
},
{
"name": "ESCU Default Configuration Hunting",
"id": "cc5895e8-3420-4ab7-af38-cf87a28f9c3b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type hunting.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"tags": {
"type": "Hunting",
"product": "ESCU"
}
},
{
"name": "ESCU Default Configuration TTP",
"id": "b81cd059-a3e8-4c03-96ca-e168c50ff70b",
"date": "2021-12-21",
"author": "Patrick Bareiss",
"description": "This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.",
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m",
"schedule_window": "auto"
},
"notable": {
"rule_description": "%description%",
"rule_title": "%name%",
"nes_fields": []
},
"rba": {
"enabled": "true"
},
"tags": {
"type": "TTP"
}
}
]
]
}
dist/api/detections.json
Vendored
+80986 -102815
View File
File diff suppressed because it is too large Load Diff
dist/api/lookups.json
Vendored
+353 -351
View File
@@ -1,351 +1,353 @@
[
{
"name": "__mlspl_unusual_commandline_detection",
"description": "An MLTK model for detecting malicious commandlines",
"filename": "__mlspl_unusual_commandline_detection.mlmodel",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "api_call_by_user_baseline",
"description": "A collection that will contain the baseline information for number of AWS API calls per user",
"collection": "api_call_by_user_baseline",
"fields_list": "arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls"
},
{
"name": "attacker_tools",
"description": "A list of tools used by attackers",
"filename": "attacker_tools.csv",
"default_match": "false",
"match_type": "WILDCARD(attacker_tool_names)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "aws_service_accounts",
"description": "A lookup file that will contain AWS Service accounts",
"filename": "aws_service_accounts.csv"
},
{
"name": "baseline_blocked_outbound_connections",
"description": "A lookup file that will contain the baseline information for number of blocked outbound connections",
"filename": "baseline_blocked_outbound_connections.csv"
},
{
"name": "brandMonitoring_lookup",
"description": "A file that contains look-a-like domains for brands that you want to monitor",
"filename": "brand_monitoring.csv",
"default_match": "false",
"match_type": "WILDCARD(domain)",
"min_matches": 1
},
{
"name": "cloud_instances_enough_data",
"description": "A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches",
"collection": "cloud_instances_enough_data",
"fields_list": "_key, filter, enough_data",
"default_match": "false",
"match_type": "WILDCARD(filter)"
},
{
"name": "csc_lookup",
"description": "The CSC control numbers and names",
"filename": "csc_lookup.csv",
"min_matches": 1
},
{
"name": "discovered_dns_records",
"description": "A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records",
"filename": "discovered_dns_records.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "domains",
"description": "A list of domains that can be ignored",
"filename": "domains.csv"
},
{
"name": "dynamic_dns_providers_default",
"description": "A list of dynammic dns providers that should not be modified",
"filename": "dynamic_dns_providers_default.csv",
"match_type": "WILDCARD(dynamic_dns_domains)",
"case_sensitive_match": "false"
},
{
"name": "dynamic_dns_providers_local",
"description": "A list of dynammic dns providers that can be modified",
"filename": "dynamic_dns_providers_local.csv",
"match_type": "WILDCARD(dynamic_dns_domains)",
"case_sensitive_match": "false"
},
{
"name": "escu_search_id_lookup",
"description": "A placeholder lookup file to hold information for ESCU Usage dashboard",
"filename": "escu_search_id.csv"
},
{
"name": "images_to_repository",
"description": "Mapping images to repositories",
"filename": "images_to_repository.csv"
},
{
"name": "is_net_windows_file",
"description": "A full baseline of executable files in \\Windows\\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.",
"filename": "is_net_windows_file.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "is_nirsoft_software",
"description": "A subset of utilities provided by NirSoft that may be used by adversaries.",
"filename": "is_nirsoft_software.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "is_suspicious_file_extension_lookup",
"description": "A list of suspicious extensions for email attachments",
"filename": "is_suspicious_file_extension_lookup.csv",
"match_type": "WILDCARD(file_name)"
},
{
"name": "is_windows_system_file",
"description": "A full baseline of executable files in Windows\\System32 and Windows\\Syswow64, including sub-directories from Server 2016 and Windows 10.",
"filename": "is_windows_system_file.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "legit_domains",
"description": "A list of legit domains to be used as an ignore list for possible phishing sites",
"filename": "legit_domains.csv"
},
{
"name": "linux_tool_discovery_process",
"description": "A list of suspicious bash commonly used by attackers via scripts",
"filename": "linux_tool_discovery_process.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "local_file_inclusion_paths",
"description": "A list of interesting files in a local file inclusion attack",
"filename": "local_file_inclusion_paths.csv",
"default_match": "false",
"match_type": "WILDCARD(local_file_inclusion_paths)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_rare_process_allow_list_default",
"description": "A list of rare processes that are legitimate that is provided by Splunk",
"filename": "rare_process_allow_list_default.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_rare_process_allow_list_local",
"description": "A list of rare processes that are legitimate provided by the end user",
"filename": "rare_process_allow_list_local.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_uncommon_processes_default",
"description": "A list of processes that are not common",
"filename": "uncommon_processes_default.csv",
"match_type": "WILDCARD(process)",
"case_sensitive_match": "false"
},
{
"name": "lookup_uncommon_processes_local",
"description": "A list of processes that are not common",
"filename": "uncommon_processes_local.csv",
"match_type": "WILDCARD(process)",
"case_sensitive_match": "false"
},
{
"name": "mandatory_job_for_workflow",
"description": "A lookup file that will be used to define the mandatory job for workflow",
"filename": "mandatory_job_for_workflow.csv"
},
{
"name": "mandatory_step_for_job",
"description": "A lookup file that will be used to define the mandatory step for job",
"filename": "mandatory_step_for_job.csv"
},
{
"name": "network_acl_activity_baseline",
"description": "A lookup file that will contain the baseline information for number of AWS Network ACL Activity",
"filename": "network_acl_activity_baseline.csv"
},
{
"name": "previously_seen_S3_access_from_remote_ip",
"description": "A placeholder for a list of IPs that have access S3",
"filename": "previously_seen_S3_access_from_remote_ip.csv"
},
{
"name": "previously_seen_api_calls_from_user_roles",
"description": "A placeholder for a list of AWS API calls for each user role",
"filename": "previously_seen_api_calls_from_user_roles.csv"
},
{
"name": "previously_seen_aws_cross_account_activity",
"description": "A placeholder for a list of AWS accounts and assumed roles",
"filename": "previously_seen_aws_cross_account_activity.csv"
},
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "previously_seen_cloud_api_calls_per_user_role",
"description": "A table of users, commands, and the first and last time that they have been seen",
"collection": "previously_seen_cloud_api_calls_per_user_role",
"fields_list": "_key, user, command, firstTimeSeen, lastTimeSeen, enough_data"
},
{
"name": "previously_seen_cloud_compute_creations_by_user",
"description": "A table of previously seen users creating cloud instances",
"collection": "previously_seen_cloud_compute_creations_by_user",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
},
{
"name": "previously_seen_cloud_compute_images",
"description": "A table of previously seen Cloud image IDs",
"collection": "previously_seen_cloud_compute_images",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, image_id, enough_data"
},
{
"name": "previously_seen_cloud_compute_instance_types",
"description": "A place holder for a list of used cloud compute instance types",
"collection": "previously_seen_cloud_compute_instance_types",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, instance_type, enough_data"
},
{
"name": "previously_seen_cloud_instance_modifications_by_user",
"description": "A table of users seen making instance modifications, and the first and last time that the activity was observed",
"collection": "previously_seen_cloud_instance_modifications_by_user",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
},
{
"name": "previously_seen_cloud_provisioning_activity_sources",
"description": "A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities",
"collection": "previously_seen_cloud_provisioning_activity_sources",
"fields_list": "_key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data"
},
{
"name": "previously_seen_cloud_regions",
"description": "A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities",
"collection": "previously_seen_cloud_regions",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data"
},
{
"name": "previously_seen_cmd_line_arguments",
"description": "A placeholder for a list of cmd line arugments that been seen before",
"filename": "previously_seen_cmd_line_arguments.csv"
},
{
"name": "previously_seen_ec2_modifications_by_user",
"description": "A place holder for a list of AWS EC2 modifications done by each user",
"filename": "previously_seen_ec2_modifications_by_user.csv"
},
{
"name": "previously_seen_gcp_storage_access_from_remote_ip",
"description": "A place holder for a list of GCP storage access from remote IPs",
"filename": "previously_seen_gcp_storage_access_from_remote_ip.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "previously_seen_running_windows_services",
"description": "A placeholder for the list of Windows Services running",
"collection": "previously_seen_running_windows_services",
"fields_list": "_key, service, firstTimeSeen, lastTimeSeen"
},
{
"name": "previously_seen_users_console_logins",
"description": "A table of users seen doing console logins, and the first and last time that the activity was observed",
"collection": "previously_seen_users_console_logins",
"fields_list": "_key, firstTime, lastTime, user, src, City, Region, Country"
},
{
"name": "prohibited_apps_launching_cmd",
"description": "A list of processes that should not be launching cmd.exe",
"filename": "prohibited_apps_launching_cmd.csv",
"match_type": "WILDCARD(prohibited_applications)"
},
{
"name": "prohibited_processes",
"description": "A list of processes that have been marked as prohibited",
"filename": "prohibited_processes.csv"
},
{
"name": "prohibited_softwares",
"description": "A list of processes that have been marked as prohibited",
"filename": "prohibited_softwares.csv"
},
{
"name": "ransomware_extensions_lookup",
"description": "A list of file extensions that are associated with ransomware",
"filename": "ransomware_extensions.csv",
"default_match": "false",
"match_type": "WILDCARD(Extensions)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "ransomware_notes_lookup",
"description": "A list of file names that are ransomware note files",
"filename": "ransomware_notes.csv",
"default_match": "false",
"match_type": "WILDCARD(ransomware_notes)",
"min_matches": 1
},
{
"name": "s3_deletion_baseline",
"description": "A placeholder for the baseline information for AWS S3 deletions",
"filename": "s3_deletion_baseline.csv"
},
{
"name": "security_group_activity_baseline",
"description": "A placeholder for the baseline information for AWS security groups",
"filename": "security_group_activity_baseline.csv"
},
{
"name": "security_services_lookup",
"description": "A list of services that deal with security",
"filename": "security_services.csv",
"default_match": "false",
"match_type": "WILDCARD(service)",
"min_matches": 1
},
{
"name": "suspicious_writes_lookup",
"description": "A list of suspicious file names",
"filename": "suspicious_files.csv",
"default_match": "false",
"match_type": "WILDCARD(file)",
"min_matches": 1
},
{
"name": "zoom_first_time_child_process",
"description": "A list of suspicious file names",
"collection": "zoom_first_time_child_process",
"fields_list": "_key, dest, process_name, firstTimeSeen, lastTimeSeen"
}
]
{
"lookups": [
{
"name": "__mlspl_unusual_commandline_detection",
"description": "An MLTK model for detecting malicious commandlines",
"filename": "__mlspl_unusual_commandline_detection.mlmodel",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "api_call_by_user_baseline",
"description": "A collection that will contain the baseline information for number of AWS API calls per user",
"collection": "api_call_by_user_baseline",
"fields_list": "arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls"
},
{
"name": "attacker_tools",
"description": "A list of tools used by attackers",
"filename": "attacker_tools.csv",
"default_match": "false",
"match_type": "WILDCARD(attacker_tool_names)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "aws_service_accounts",
"description": "A lookup file that will contain AWS Service accounts",
"filename": "aws_service_accounts.csv"
},
{
"name": "baseline_blocked_outbound_connections",
"description": "A lookup file that will contain the baseline information for number of blocked outbound connections",
"filename": "baseline_blocked_outbound_connections.csv"
},
{
"name": "brandMonitoring_lookup",
"description": "A file that contains look-a-like domains for brands that you want to monitor",
"filename": "brand_monitoring.csv",
"default_match": "false",
"match_type": "WILDCARD(domain)",
"min_matches": 1
},
{
"name": "cloud_instances_enough_data",
"description": "A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches",
"collection": "cloud_instances_enough_data",
"fields_list": "_key, filter, enough_data",
"default_match": "false",
"match_type": "WILDCARD(filter)"
},
{
"name": "csc_lookup",
"description": "The CSC control numbers and names",
"filename": "csc_lookup.csv",
"min_matches": 1
},
{
"name": "discovered_dns_records",
"description": "A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records",
"filename": "discovered_dns_records.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "domains",
"description": "A list of domains that can be ignored",
"filename": "domains.csv"
},
{
"name": "dynamic_dns_providers_default",
"description": "A list of dynammic dns providers that should not be modified",
"filename": "dynamic_dns_providers_default.csv",
"match_type": "WILDCARD(dynamic_dns_domains)",
"case_sensitive_match": "false"
},
{
"name": "dynamic_dns_providers_local",
"description": "A list of dynammic dns providers that can be modified",
"filename": "dynamic_dns_providers_local.csv",
"match_type": "WILDCARD(dynamic_dns_domains)",
"case_sensitive_match": "false"
},
{
"name": "escu_search_id_lookup",
"description": "A placeholder lookup file to hold information for ESCU Usage dashboard",
"filename": "escu_search_id.csv"
},
{
"name": "images_to_repository",
"description": "Mapping images to repositories",
"filename": "images_to_repository.csv"
},
{
"name": "is_net_windows_file",
"description": "A full baseline of executable files in \\Windows\\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.",
"filename": "is_net_windows_file.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "is_nirsoft_software",
"description": "A subset of utilities provided by NirSoft that may be used by adversaries.",
"filename": "is_nirsoft_software.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "is_suspicious_file_extension_lookup",
"description": "A list of suspicious extensions for email attachments",
"filename": "is_suspicious_file_extension_lookup.csv",
"match_type": "WILDCARD(file_name)"
},
{
"name": "is_windows_system_file",
"description": "A full baseline of executable files in Windows\\System32 and Windows\\Syswow64, including sub-directories from Server 2016 and Windows 10.",
"filename": "is_windows_system_file.csv",
"default_match": "false",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "legit_domains",
"description": "A list of legit domains to be used as an ignore list for possible phishing sites",
"filename": "legit_domains.csv"
},
{
"name": "linux_tool_discovery_process",
"description": "A list of suspicious bash commonly used by attackers via scripts",
"filename": "linux_tool_discovery_process.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "local_file_inclusion_paths",
"description": "A list of interesting files in a local file inclusion attack",
"filename": "local_file_inclusion_paths.csv",
"default_match": "false",
"match_type": "WILDCARD(local_file_inclusion_paths)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_rare_process_allow_list_default",
"description": "A list of rare processes that are legitimate that is provided by Splunk",
"filename": "rare_process_allow_list_default.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_rare_process_allow_list_local",
"description": "A list of rare processes that are legitimate provided by the end user",
"filename": "rare_process_allow_list_local.csv",
"default_match": "false",
"match_type": "WILDCARD(process)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "lookup_uncommon_processes_default",
"description": "A list of processes that are not common",
"filename": "uncommon_processes_default.csv",
"match_type": "WILDCARD(process)",
"case_sensitive_match": "false"
},
{
"name": "lookup_uncommon_processes_local",
"description": "A list of processes that are not common",
"filename": "uncommon_processes_local.csv",
"match_type": "WILDCARD(process)",
"case_sensitive_match": "false"
},
{
"name": "mandatory_job_for_workflow",
"description": "A lookup file that will be used to define the mandatory job for workflow",
"filename": "mandatory_job_for_workflow.csv"
},
{
"name": "mandatory_step_for_job",
"description": "A lookup file that will be used to define the mandatory step for job",
"filename": "mandatory_step_for_job.csv"
},
{
"name": "network_acl_activity_baseline",
"description": "A lookup file that will contain the baseline information for number of AWS Network ACL Activity",
"filename": "network_acl_activity_baseline.csv"
},
{
"name": "previously_seen_S3_access_from_remote_ip",
"description": "A placeholder for a list of IPs that have access S3",
"filename": "previously_seen_S3_access_from_remote_ip.csv"
},
{
"name": "previously_seen_api_calls_from_user_roles",
"description": "A placeholder for a list of AWS API calls for each user role",
"filename": "previously_seen_api_calls_from_user_roles.csv"
},
{
"name": "previously_seen_aws_cross_account_activity",
"description": "A placeholder for a list of AWS accounts and assumed roles",
"filename": "previously_seen_aws_cross_account_activity.csv"
},
{
"name": "previously_seen_aws_regions",
"description": "A place holder for a list of used AWS regions",
"filename": "previously_seen_aws_regions.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "previously_seen_cloud_api_calls_per_user_role",
"description": "A table of users, commands, and the first and last time that they have been seen",
"collection": "previously_seen_cloud_api_calls_per_user_role",
"fields_list": "_key, user, command, firstTimeSeen, lastTimeSeen, enough_data"
},
{
"name": "previously_seen_cloud_compute_creations_by_user",
"description": "A table of previously seen users creating cloud instances",
"collection": "previously_seen_cloud_compute_creations_by_user",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
},
{
"name": "previously_seen_cloud_compute_images",
"description": "A table of previously seen Cloud image IDs",
"collection": "previously_seen_cloud_compute_images",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, image_id, enough_data"
},
{
"name": "previously_seen_cloud_compute_instance_types",
"description": "A place holder for a list of used cloud compute instance types",
"collection": "previously_seen_cloud_compute_instance_types",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, instance_type, enough_data"
},
{
"name": "previously_seen_cloud_instance_modifications_by_user",
"description": "A table of users seen making instance modifications, and the first and last time that the activity was observed",
"collection": "previously_seen_cloud_instance_modifications_by_user",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
},
{
"name": "previously_seen_cloud_provisioning_activity_sources",
"description": "A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities",
"collection": "previously_seen_cloud_provisioning_activity_sources",
"fields_list": "_key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data"
},
{
"name": "previously_seen_cloud_regions",
"description": "A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities",
"collection": "previously_seen_cloud_regions",
"fields_list": "_key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data"
},
{
"name": "previously_seen_cmd_line_arguments",
"description": "A placeholder for a list of cmd line arugments that been seen before",
"filename": "previously_seen_cmd_line_arguments.csv"
},
{
"name": "previously_seen_ec2_modifications_by_user",
"description": "A place holder for a list of AWS EC2 modifications done by each user",
"filename": "previously_seen_ec2_modifications_by_user.csv"
},
{
"name": "previously_seen_gcp_storage_access_from_remote_ip",
"description": "A place holder for a list of GCP storage access from remote IPs",
"filename": "previously_seen_gcp_storage_access_from_remote_ip.csv",
"default_match": "false",
"min_matches": 1
},
{
"name": "previously_seen_running_windows_services",
"description": "A placeholder for the list of Windows Services running",
"collection": "previously_seen_running_windows_services",
"fields_list": "_key, service, firstTimeSeen, lastTimeSeen"
},
{
"name": "previously_seen_users_console_logins",
"description": "A table of users seen doing console logins, and the first and last time that the activity was observed",
"collection": "previously_seen_users_console_logins",
"fields_list": "_key, firstTime, lastTime, user, src, City, Region, Country"
},
{
"name": "prohibited_apps_launching_cmd",
"description": "A list of processes that should not be launching cmd.exe",
"filename": "prohibited_apps_launching_cmd.csv",
"match_type": "WILDCARD(prohibited_applications)"
},
{
"name": "prohibited_processes",
"description": "A list of processes that have been marked as prohibited",
"filename": "prohibited_processes.csv"
},
{
"name": "prohibited_softwares",
"description": "A list of processes that have been marked as prohibited",
"filename": "prohibited_softwares.csv"
},
{
"name": "ransomware_extensions_lookup",
"description": "A list of file extensions that are associated with ransomware",
"filename": "ransomware_extensions.csv",
"default_match": "false",
"match_type": "WILDCARD(Extensions)",
"min_matches": 1,
"case_sensitive_match": "false"
},
{
"name": "ransomware_notes_lookup",
"description": "A list of file names that are ransomware note files",
"filename": "ransomware_notes.csv",
"default_match": "false",
"match_type": "WILDCARD(ransomware_notes)",
"min_matches": 1
},
{
"name": "s3_deletion_baseline",
"description": "A placeholder for the baseline information for AWS S3 deletions",
"filename": "s3_deletion_baseline.csv"
},
{
"name": "security_group_activity_baseline",
"description": "A placeholder for the baseline information for AWS security groups",
"filename": "security_group_activity_baseline.csv"
},
{
"name": "security_services_lookup",
"description": "A list of services that deal with security",
"filename": "security_services.csv",
"default_match": "false",
"match_type": "WILDCARD(service)",
"min_matches": 1
},
{
"name": "suspicious_writes_lookup",
"description": "A list of suspicious file names",
"filename": "suspicious_files.csv",
"default_match": "false",
"match_type": "WILDCARD(file)",
"min_matches": 1
},
{
"name": "zoom_first_time_child_process",
"description": "A list of suspicious file names",
"collection": "zoom_first_time_child_process",
"fields_list": "_key, dest, process_name, firstTimeSeen, lastTimeSeen"
}
]
}
dist/api/macros.json
Vendored
+687 -680
View File
File diff suppressed because it is too large Load Diff
dist/api/response_tasks.json
Vendored
+1914 -1912
View File
File diff suppressed because it is too large Load Diff
dist/api/stories.json
Vendored
+296566 -366277
View File
File diff suppressed because one or more lines are too long
lookups/mitre_enrichment.csv
+16
View File
@@ -438,3 +438,19 @@ T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
T1204.003,Malicious Image,Execution,no
T1580,Cloud Infrastructure Discovery,Discovery,no
T1547.014,Active Setup,Persistence|Privilege Escalation,no
T1595,Active Scanning,Reconnaissance,no
T1558.004,AS-REP Roasting,Credential Access,no
T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
T1016.001,Internet Connection Discovery,Discovery,no
T1547.012,Print Processors,Persistence|Privilege Escalation,no
T1592,Gather Victim Host Information,Reconnaissance,no
T1218.012,Verclsid,Defense Evasion,no
T1590,Gather Victim Network Information,Reconnaissance,no
T1590.005,IP Addresses,Reconnaissance,no
T1588.002,Tool,Resource Development,no
T1557.002,ARP Cache Poisoning,Credential Access|Collection,no
T1542.005,TFTP Boot,Defense Evasion|Persistence,no
T1020.001,Traffic Duplication,Exfiltration,no
1 mitre_id technique tactics groups
438 T1005 Data from Local System Collection Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
439 T1003 OS Credential Dumping Credential Access APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
440 T1001 Data Obfuscation Command And Control Axiom
441 T1204.003 Malicious Image Execution no
442 T1580 Cloud Infrastructure Discovery Discovery no
443 T1547.014 Active Setup Persistence|Privilege Escalation no
444 T1595 Active Scanning Reconnaissance no
445 T1558.004 AS-REP Roasting Credential Access no
446 T1053.006 Systemd Timers Execution|Persistence|Privilege Escalation no
447 T1016.001 Internet Connection Discovery Discovery no
448 T1547.012 Print Processors Persistence|Privilege Escalation no
449 T1592 Gather Victim Host Information Reconnaissance no
450 T1218.012 Verclsid Defense Evasion no
451 T1590 Gather Victim Network Information Reconnaissance no
452 T1590.005 IP Addresses Reconnaissance no
453 T1588.002 Tool Resource Development no
454 T1557.002 ARP Cache Poisoning Credential Access|Collection no
455 T1542.005 TFTP Boot Defense Evasion|Persistence no
456 T1020.001 Traffic Duplication Exfiltration no