From f12d9a90bb6d2663243faee7c7d019479655449a Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 29 Mar 2021 16:49:13 +0200 Subject: [PATCH] updated test file --- .../endpoint/ssa___detect_pass_hash.yml | 20 ++++++++++--------- .../endpoint/ssa___detect_pass_hash.test.yml | 6 ++++-- 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 38a964792b..a44b1e60b9 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -7,15 +7,17 @@ type: streaming datamodel: [] description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. -search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"), - EventCode=map_get(input_event, "event_code"), LogonType=map_get(input_event, "logon_type"), - LogonProcess=map_get(input_event, "logon_process"), ComputerName=map_get(input_event, - "dest_ip_primary_artifact"), AccountName=map_get(input_event, "dest_user_primary_artifact") - | where (LogonType="3" AND LogonProcess="NtLmSsp" AND AccountName IS NOT NULL) OR - (LogonType="9" AND LogonProcess="seclogo") | first_time_event input_columns=["EventCode","LogonProcess","ComputerName"] - | where first_time_EventCode_LogonProcess_ComputerName | eval start_time=_time, - end_time=_time, body="TBD", entities="TBD" | select start_time, end_time, entities, - body | into write_ssa_detected_events(); ' +search: ' | from read_ssa_enriched_events() + + | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)) + | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event, "authentication_type"), + authentication_method=map_get(input_event, "authentication_method"), origin_device_domain=map_get(input_event, + "origin_device_domain") + | where (authentication_type="3" AND authentication_method="NtLmSsp") OR + (authentication_type="9" AND authentication_method="seclogo") + + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id, + dest_user_id), body="TBD" | into write_ssa_detected_events();' how_to_implement: The test data is converted from Windows Security Event logs generated from Attach Range simulation and used in SPL search and extended to SPL2 known_false_positives: Legitimate logon activity by authorized NTLM systems may be diff --git a/tests/endpoint/ssa___detect_pass_hash.test.yml b/tests/endpoint/ssa___detect_pass_hash.test.yml index eab9f2d4b2..f0f2098ac0 100644 --- a/tests/endpoint/ssa___detect_pass_hash.test.yml +++ b/tests/endpoint/ssa___detect_pass_hash.test.yml @@ -5,6 +5,8 @@ tests: pass_condition: '@count_gt(0)' description: Test detection of pass-the-hash attack_data: - - file_name: T1550.002.json - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log + source: WinEventLog:Security +