admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'spec_update' of github.com:splunk/security-content into spec_update

Browse Source
This commit is contained in:
divious1
2019-04-19 10:59:41 -04:00
parent a4efc519f9 7e8f267b81
commit fa3e66bf07
5 changed files with 8500 additions and 8720 deletions
Download Patch File Download Diff File Expand all files Collapse all files
baselines/discover_dns_records.json
+1
View File
@@ -2,6 +2,7 @@
"baseline": {
"splunk": {
"schedule": {
"cron_schedule": "0 0 1 * *",
"earliest_time": "-30d@d",
"latest_time": "-10m@m"
},
detections/dyn_dns_queries.json
+23 -21
View File
@@ -18,27 +18,29 @@
"description": "Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, blacklists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. ",
"detect": {
"splunk": {
"notable": {
"nes_fields": "answer, src, query",
"rule_description": "The search has detected a host making outbound queries to Dynamic DNS providers",
"rule_title": "Host $src$ detected to make a query to a Dynamic DNS provider"
},
"risk": {
"risk_object": "src",
"risk_object_type": [
"system"
],
"risk_score": 20
},
"schedule": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count values(DNS.answer) as \"Dynamic DNS Resolutions\" min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(\"DNS\")` | `ctime(firstTime)` | `dynamic_dns_providers`",
"suppress": {
"suppress_fields": "src, query",
"suppress_period": "86400s"
"correlation_rule": {
"notable": {
"nes_fields": "answer, src, query",
"rule_description": "The search has detected a host making outbound queries to Dynamic DNS providers",
"rule_title": "Host $src$ detected to make a query to a Dynamic DNS provider"
},
"risk": {
"risk_object": "src",
"risk_object_type": [
"system"
],
"risk_score": 20
},
"schedule": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count values(DNS.answer) as \"Dynamic DNS Resolutions\" min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name(\"DNS\")` | `ctime(firstTime)` | `dynamic_dns_providers`",
"suppress": {
"suppress_fields": "src, query",
"suppress_period": "86400s"
}
}
}
},
src/default/analytics_stories.conf
+1168
View File
File diff suppressed because it is too large Load Diff
src/default/savedsearches.conf
+7300 -8691
View File
File diff suppressed because it is too large Load Diff
src/default/use_case_library.conf
+8 -8
View File
@@ -5,7 +5,7 @@ version = 1.0
reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
spec_version = 1
searches = ["AWS Cross Account Activity From Previously Unseen Account", "AWS Investigate User Activities By AccessKeyId", "AWS Investigate User Activities By Source User", "Previously Seen AWS Cross Account"]
searches = ["AWS Cross Account Activity From Previously Unseen Account", "AWS Investigate User Activities By AccessKeyId", "AWS Investigate User Activities By Source User", "Previously Seen AWS Cross Account Activity"]
description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\
\
@@ -78,7 +78,7 @@ version = 1.0
reference = ["https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}, {"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
spec_version = 1
searches = ["Identify New User Accounts", "Short Lived Windows Accounts", "Detect Excessive Account Lockouts From Endpoint", "Detect Excessive User Account Lockouts", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint"]
searches = ["Identify New User Accounts", "Short Lived Windows Accounts", "Detect Excessive Account Lockouts From Endpoint", "Detect Excessive User Account Lockouts", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint", "Discover DNS records", "Get Logon Rights Modifications For User", "Get Logon Rights Modifications For Endpoint"]
description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.
narrative = Monitoring user accounts within your enterprise is a critical analytic function that helps ensure that credential and access policies/procedures are properly implemented and are being enforced. Proactive ad-hoc hunting, as well as routine monitoring, can ensure user or system accounts are not being abused by unauthorized individuals or processes. In the event of a network event or breach, user-authentication logs are a key resource in determining if or how an account might have been compromised or co-opted, leading to suspicious or malicious activity.
@@ -182,7 +182,7 @@ version = 1.0
reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["Detect Large Outbound ICMP Packets", "Protocol or Port Mismatch", "Detection of DNS Tunnels", "TOR Traffic", "Prohibited Network Traffic Allowed", "Clients Connecting to Multiple DNS Servers", "DNS Query Length With High Standard Deviation", "Detect hosts connecting to dynamic domain providers", "Excessive DNS Failures", "Detect Long DNS TXT Record Response", "DNS Query Requests Resolved by Unauthorized DNS Servers", "Detect Spike in blocked Outbound Traffic from your AWS", "Get Process Info", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get All AWS Activity From IP Address", "Get Process Information For Port Activity", "Baseline of blocked outbound traffic from AWS", "Get Process Information For Port Activity", "Count of Unique IPs Connecting to Ports", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get All AWS Activity From IP Address", "Baseline of blocked outbound traffic from AWS"]
searches = ["Detect Large Outbound ICMP Packets", "Protocol or Port Mismatch", "Detection of DNS Tunnels", "TOR Traffic", "Prohibited Network Traffic Allowed", "Clients Connecting to Multiple DNS Servers", "DNS Query Length With High Standard Deviation", "Detect hosts connecting to dynamic domain providers", "Excessive DNS Failures", "Detect Long DNS TXT Record Response", "DNS Query Requests Resolved by Unauthorized DNS Servers", "Detect Spike in blocked Outbound Traffic from your AWS", "Get Process Info", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get All AWS Activity From IP Address", "Get Process Information For Port Activity", "Baseline of blocked outbound traffic from AWS", "Get Process Information For Port Activity", "Count of Unique IPs Connecting to Ports", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get All AWS Activity From IP Address", "Baseline of blocked outbound traffic from AWS"]
description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
\
@@ -251,7 +251,7 @@ version = 1.0
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 2
searches = ["DNS record changed", "Investigate AWS User Activities by user field", "Create a list of approved AWS service accounts", "Baseline of API Calls per User ARN", "Previously seen API call per user roles in CloudTrail", "Baseline of Security Group Activity by ARN", "Investigate AWS activities via region name", "AWS Investigate User Activities By ARN", "Get All AWS Activity From IP Address", "Previously seen S3 bucket access by remote IP", "Baseline of S3 Bucket deletion activity by ARN"]
searches = ["DNS record changed", "Clients Connecting to Multiple DNS Servers", "Detect hosts connecting to dynamic domain providers", "DNS Query Requests Resolved by Unauthorized DNS Servers", "Get DNS Server History for a host", "Discover DNS records", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS Server History for a host"]
description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\
\
@@ -278,7 +278,7 @@ version = 1.0
reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 1
searches = ["Detection of DNS Tunnels", "Detect USB device insertion", "Detect hosts connecting to dynamic domain providers", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic"]
searches = ["Detection of DNS Tunnels", "Detect USB device insertion", "Detect hosts connecting to dynamic domain providers", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host"]
description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.
@@ -300,7 +300,7 @@ version = 2.0
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 1
searches = ["Detect hosts connecting to dynamic domain providers", "Detect web traffic to dynamic domain providers", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Investigate Web Activity From src_ip"]
searches = ["Detect hosts connecting to dynamic domain providers", "Detect web traffic to dynamic domain providers", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Investigate Web Activity From src_ip"]
description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.
narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.
@@ -588,7 +588,7 @@ version = 1.0
reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["TOR Traffic", "Prohibited Network Traffic Allowed", "Protocol or Port Mismatch", "Detect hosts connecting to dynamic domain providers", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Information For Port Activity", "Count of Unique IPs Connecting to Ports", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic"]
searches = ["TOR Traffic", "Prohibited Network Traffic Allowed", "Protocol or Port Mismatch", "Detect hosts connecting to dynamic domain providers", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Info", "Get Process Information For Port Activity", "Investigate Web Activity From Host", "Get Parent Process Info", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes", "Get Process Information For Port Activity", "Count of Unique IPs Connecting to Ports", "Get DNS Server History for a host"]
description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.
@@ -779,7 +779,7 @@ version = 1.0
reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
spec_version = 1
searches = ["Excessive DNS Failures", "Clients Connecting to Multiple DNS Servers", "DNS Query Length With High Standard Deviation", "DNS Query Requests Resolved by Unauthorized DNS Servers", "Detect Long DNS TXT Record Response", "Detection of DNS Tunnels", "Detect hosts connecting to dynamic domain providers", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic"]
searches = ["Excessive DNS Failures", "Clients Connecting to Multiple DNS Servers", "DNS Query Length With High Standard Deviation", "DNS Query Requests Resolved by Unauthorized DNS Servers", "Detect Long DNS TXT Record Response", "Detection of DNS Tunnels", "Detect hosts connecting to dynamic domain providers", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Process responsible for the DNS traffic", "Get DNS Server History for a host"]
description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.