admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-09-14 09:54:23 -07:00
committed by GitHub
parent ddbb466f31 9528137367
commit f3c7bb7af7
9 changed files with 40 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/adsisearcher_account_discovery.yml
+7 -9
View File
@@ -1,7 +1,7 @@
name: AdsiSearcher Account Discovery
id: de7fcadc-04f3-11ec-a241-acde48001122
version: 1
date: '2021-08-24'
version: 2
date: '2022-11-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -9,10 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
domain users for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*"
Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `adsisearcher_account_discovery_filter`'
search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
by EventCode Computer ScriptBlockText UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
@@ -30,7 +28,7 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log
impact: 50
kill_chain_phases:
- Reconnaissance
@@ -39,11 +37,11 @@ tags:
- T1087.002
- T1087
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
detections/endpoint/get_aduser_with_powershell_script_block.yml
+6 -6
View File
@@ -1,7 +1,7 @@
name: Get ADUser with PowerShell Script Block
id: 21432e40-04f4-11ec-b7e6-acde48001122
version: 1
date: '2021-08-24'
version: 2
date: '2022-09-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: Hunting
datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
is used to return a list of all domain users. Red Teams and adversaries may leverage
this commandlet to enumerate domain groups for situational awareness and Active
Directory Discovery.
search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
| `get_aduser_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,7 +30,7 @@ tags:
- Source:Endpoint
- Stage:Discovery
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log
impact: 50
kill_chain_phases:
- Reconnaissance
detections/endpoint/get_domainuser_with_powershell_script_block.yml
+5 -5
View File
@@ -1,7 +1,7 @@
name: Get DomainUser with PowerShell Script Block
id: 61994268-04f4-11ec-865c-acde48001122
version: 2
date: '2022-03-22'
version: 3
date: '2022-11-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
Red Teams and adversaries alike may use PowerView to enumerate domain users for
situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*"
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `get_domainuser_with_powershell_script_block_filter`'
@@ -38,11 +38,11 @@ tags:
- T1087.002
- T1087
observable:
- name: ComputerName
- name: Computer
type: Hostname
role:
- Victim
- name: User
- name: UserID
type: User
role:
- Victim
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+4 -4
View File
@@ -1,7 +1,7 @@
name: Recursive Delete of Directory In Batch CMD
id: ba570b3a-d356-11eb-8358-acde48001122
version: 2
date: '2021-06-22'
version: 3
date: '2022-11-12'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
@@ -11,8 +11,8 @@ description: This search is to detect a suspicious commandline designed to delet
(reddot) where it it tries to delete the files in recycle bin to impaire user from
recovering deleted files.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process=*
rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name
as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c* Processes.process="*
rd *" Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name
Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id
Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+4 -7
View File
@@ -1,7 +1,7 @@
name: Remote Process Instantiation via WMI and PowerShell Script Block
id: 2a048c14-4634-11ec-a618-3e22fbd008af
version: 1
date: '2021-11-15'
version: 2
date: '2022-11-15'
author: Mauricio Velazco, Splunk
type: TTP
datamodel: []
@@ -9,10 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
alike may abuse WMI and this commandlet for lateral movement and remote code execution.
search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
search: '`powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -30,7 +27,7 @@ tags:
- Source:Endpoint
- Stage:Lateral Movement
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log
impact: 90
kill_chain_phases:
- Exploitation
detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+2 -2
View File
@@ -1,6 +1,6 @@
name: Svchost LOLBAS Execution Process Spawn
id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
version: 1
version: 2
date: '2021-11-22'
author: Mauricio Velazco, Splunk
type: TTP
@@ -50,7 +50,7 @@ tags:
impact: 90
kill_chain_phases:
- Exploitation
message: Svchost.exe spawned a LOLBAS process on $dest
message: Svchost.exe spawned a LOLBAS process on $dest$
mitre_attack_id:
- T1053
- T1053.005
tests/endpoint/adsisearcher_account_discovery.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: adsisearcher_powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher_powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
tests/endpoint/get_aduser_with_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: WinEventLog
- file_name: aduser_powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/aduser_powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog
tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml
+4 -4
View File
@@ -6,7 +6,7 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log
source: WinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: wineventlog
- file_name: wmi_remote_process_powershell.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/wmi_remote_process_powershell.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: XmlWinEventLog