diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 73c75b0e8c..65dece8106 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -1,17 +1,19 @@ name: O365 Excessive Authentication Failures Alert id: d441364c-349c-453b-b55f-12eccab67cf9 -version: 1 -date: '2020-12-16' +version: 2 +date: '2022-02-18' author: Rod Soto, Splunk type: Anomaly datamodel: [] description: This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes -search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* - status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) - AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status - values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=failure + | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod + values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user + | where count > 10 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `o365_excessive_authentication_failures_alert_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: The threshold for alert is above 10 attempts and this should diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index bbcab20120..dc693a7c50 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -1,7 +1,7 @@ name: Detect Regasm with Network Connection id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f -version: 1 -date: '2021-02-16' +version: 2 +date: '2022-02-18' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -15,10 +15,12 @@ description: The following analytic identifies regasm.exe with a network connect and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime - max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`' +search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regasm.exe + | rename Computer as dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_regasm_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -59,7 +61,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -77,7 +79,7 @@ tags: - dest_ip - process_name - Computer - - User + - user - src_ip - dest_host - dest_ip diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index 7329369714..dd41e27b88 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -1,7 +1,7 @@ name: Detect Regsvcs with Network Connection id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a -version: 1 -date: '2021-02-16' +version: 2 +date: '2022-02-18' author: Michael Haag, Splunk type: TTP datamodel: [] @@ -15,10 +15,12 @@ description: The following analytic identifies Regsvcs.exe with a network connec and review accordingly. Review the reputation of the remote IP or domain and block as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. -search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 - process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime - max(_time) as lastTime by dest, User, process_name, src_ip, dest_host, dest_ip | - `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`' +search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16 process_name=regsvcs.exe + | rename Computer as dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `detect_regsvcs_with_network_connection_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -59,7 +61,7 @@ tags: type: User role: - Victim - - name: Computer + - name: dest type: Hostname role: - Victim @@ -77,7 +79,7 @@ tags: - dest_ip - process_name - Computer - - User + - user - src_ip - dest_host risk_score: 80 diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml index eb2c580a34..40bdb14ab8 100644 --- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -1,7 +1,7 @@ name: Interactive Session on Remote Endpoint with PowerShell id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af -version: 1 -date: '2021-11-18' +version: 2 +date: '2022-02-18' author: Mauricio Velazco, Splunk type: TTP datamodel: [] @@ -10,9 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution. -search: powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter` +search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `interactive_session_on_remote_endpoint_with_powershell_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index 6a198c5242..dc81093e1c 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -1,7 +1,7 @@ name: NET Profiler UAC bypass id: 0252ca80-e30d-11eb-8aa3-acde48001122 -version: 1 -date: '2021-07-12' +version: 2 +date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -12,11 +12,14 @@ description: This search is to detect modification of registry to bypass UAC win the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" - Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Registry where + Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_data = "*.dll" + by Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `net_profiler_uac_bypass_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index fe08533824..4a76a32e9a 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,7 +1,7 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 1 -date: '2022-01-20' +version: 2 +date: '2022-01-18' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,10 +11,11 @@ description: This analytic will identify a suspicious PowerShell command used to campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation. -search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows - Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `powershell_remove_windows_defender_directory_filter`' +search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_remove_windows_defender_directory_filter` ' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 92a9f3a6d7..7a93edb934 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -1,7 +1,7 @@ name: Process Deleting Its Process File Path id: f7eda4bc-871c-11eb-b110-acde48001122 -version: 1 -date: '2021-03-17' +version: 2 +date: '2022-02-18' author: Teoderick Contreras type: TTP datamodel: @@ -11,11 +11,13 @@ description: This detection is to identify a suspicious process that tries to de evasion once a certain condition of malware is satisfied or not. Clop ransomware use this technique where it will try to delete its process file path using a .bat command if the keyboard layout is not the layout it tries to infect. -search: '`sysmon` EventCode=1 cmdline = "* /c *" cmdline = "* del*" Image = "*\\cmd.exe" - |eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") | - stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage - ParentCommandLine Image cmdline EventCode ProcessID result | where result = "Found" - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_deleting_its_process_file_path_filter`' +search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image = "*\\cmd.exe" + | eval result = if(like(process,"%".parent_process."%"), "Found", "Not Found") + | stats min(_time) as firstTime max(_time) as lastTime count by Computer user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result + | where result = "Found" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `process_deleting_its_process_file_path_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. @@ -34,8 +36,8 @@ tags: automated_detection_testing: passed confidence: 100 context: - - source:endpoint - - stage: Credential Access + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log impact: 60 @@ -51,7 +53,7 @@ tags: role: - Victim - name: user - type: user + type: User role: - Victim product: diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index d542ef031f..72503d8052 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -1,7 +1,7 @@ name: Rundll32 DNSQuery id: f1483f5e-ee29-11eb-9d23-acde48001122 -version: 1 -date: '2021-07-26' +version: 2 +date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -11,9 +11,10 @@ description: This search is to detect a suspicious rundll32.exe process having a malware where the rundll32 that execute its payload will contact amazon.com to check internet connect and to communicate to its C&C server to download config and other file component. -search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time) - as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId direction - Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`sysmon` EventCode=22 process_name="rundll32.exe" + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. @@ -59,7 +60,6 @@ tags: - QueryName - QueryStatus - ProcessId - - direction - Computer risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 2f6666750a..09fdaff5e6 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,18 +1,20 @@ name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d -version: 6 -date: '2020-11-06' +version: 7 +date: '2022-02-18' author: Patrick Bareiss, Splunk type: TTP datamodel: - Endpoint description: Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* - Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted - OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name - Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from + datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* + Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted OR Registry.registry_value_data=Bypass) + by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be diff --git a/tests/endpoint/process_execution_via_wmi.test.yml b/tests/endpoint/process_execution_via_wmi.test.yml index 3c1b9ee8b9..23f82aae83 100644 --- a/tests/endpoint/process_execution_via_wmi.test.yml +++ b/tests/endpoint/process_execution_via_wmi.test.yml @@ -2,7 +2,7 @@ name: Process execution via wmi Unit Test tests: - name: Process execution via wmi file: endpoint/process_execution_via_wmi.yml - pass_condition: '| stats count | where count = 1' + pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: