From 4457d5d5f1afd3a093a895f53f1a9a7bc75643e2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 29 Aug 2022 20:06:06 -0400 Subject: [PATCH 01/90] pushing analytic story --- stories/windows_domain_controller_attacks.yml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 stories/windows_domain_controller_attacks.yml diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml new file mode 100644 index 0000000000..aafcb1cf34 --- /dev/null +++ b/stories/windows_domain_controller_attacks.yml @@ -0,0 +1,20 @@ +name: Windows Domain Controller Attacks +id: f676c4c1-c769-4ecb-9611-5fd85b497c56 +version: 1 +date: '2022-08-29' +author: Dean Luxton, Mauricio Velazco +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Windows Domain Controller Attacks + category: + - Adversary Tactics + - Account Compromise + - Lateral Movement + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 6ae65351f551cb99d75fc0d7513bb720dfea0f64 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 2 Sep 2022 13:01:05 +1000 Subject: [PATCH 02/90] Adding DCShadow detection --- detections/endpoint/dcshadow_attack.yml | 83 +++++++++++++++++++++++++ tests/endpoint/dcshadow_attack.test.yml | 13 ++++ 2 files changed, 96 insertions(+) create mode 100644 detections/endpoint/dcshadow_attack.yml create mode 100644 tests/endpoint/dcshadow_attack.test.yml diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml new file mode 100644 index 0000000000..e89ae20644 --- /dev/null +++ b/detections/endpoint/dcshadow_attack.yml @@ -0,0 +1,83 @@ +name: DCShadow Attack +id: b500b64d-5330-4c92-9581-e4c3f0728621 +version: 1 +date: '2022-09-02' +author: Dean Luxton +type: TTP +datamodel: [] +description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. +search: "```XML-Wineventlog Detection```\n`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\ + \ (AttributeValue=\"GC/*\" OR AttributeValue=\"E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\ + )\n| replace \"%%14674\" with \"Value Added\", \"%%14675\" with \"Value Deleted\"\ + \ in OperationType\n| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType)\ + \ as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN,\ + \ Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer Logon_ID [|\ + \ search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID\ + \ src_ip as src]\n| table firstEvent, latestEvent, duration, src_nt_domain, src_user,\ + \ Computer, ObjectDN, Action, signature, src, Logon_ID\n| eval firstEvent=strftime(firstEvent,\ + \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\ + )\n\n```Non-XML Wineventlog Detection\n`wineventlog_security` EventCode=5136 LDAP_Display_Name=servicePrincipalName\n\ + (Value=\"*GC/*\" OR Value=\"*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\")\n| stats\ + \ min(_time) as firstEvent max(_time) as latestEvent values(eval(mvfilter(match(Type,\"\ + Value\")))) as Action range(_time) as duration by Account_Domain, Account_Name,\ + \ ComputerName, DN, Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer\ + \ Logon_ID [| search index=win EventCode=4624 | eval Logon_ID=if(mvcount(Logon_ID)>1,mvindex(Logon_ID,1),'Logon_ID'),\ + \ Account_Domain=if(mvcount(Account_Domain)>1,mvindex(Account_Domain,1),'Account_Domain'),\ + \ Account_Name=if(mvcount(Account_Name)>1,mvindex(Account_Name,1),'Account_Name')]\n\ + | table firstEvent, latestEvent, duration, Account_Domain, Account_Name, ComputerName,\ + \ DN, Action, signature, status, src, Logon_ID, Logon_GUID\n| eval firstEvent=strftime(firstEvent,\ + \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\ + )``` | `dcshadow_attack_filter`" +how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties` applied to the domain root and all descendant objects. +known_false_positives: None. +references: +- https://www.dcshadow.com/ +- https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: DCShadow Attack Detected from $src$ + mitre_attack_id: + - T1207 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: src + type: IP + role: + - Attacker +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - AttributeLDAPDisplayName + - AttributeValue + - src_nt_domain + - src_user + - Computer + - ObjectDN + - Logon_ID + - signature + risk_score: 100 + security_domain: endpoint diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/dcshadow_attack.test.yml new file mode 100644 index 0000000000..04c3d4f9d4 --- /dev/null +++ b/tests/endpoint/dcshadow_attack.test.yml @@ -0,0 +1,13 @@ +name: DCShadow Attack Unit Test +tests: +- name: DCShadow Attack + file: endpoint/dcshadow_attack.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From 39083d5a00cddba7ad733f4599b8083fd2f2c1a9 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 2 Sep 2022 13:32:06 +1000 Subject: [PATCH 03/90] Adding DCShadow detection --- detections/endpoint/dcshadow_attack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index e89ae20644..f7a971ed20 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -64,7 +64,7 @@ tags: type: IP role: - Attacker -product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud From e22b2740040c40c0d30b0ac11d98b2e3c64b9480 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 2 Sep 2022 13:41:15 +1000 Subject: [PATCH 04/90] Adding DCShadow detection --- detections/endpoint/dcshadow_attack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index f7a971ed20..096a37a643 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -44,7 +44,7 @@ tags: confidence: 100 context: - Source:Endpoint - - Stage:Actions on Objectives + - Stage:Defense Evasion dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log impact: 100 From ec35919294987645d8b3bcdd57db88faa3331e08 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 2 Sep 2022 13:45:46 +1000 Subject: [PATCH 05/90] Adding DCShadow detection --- detections/endpoint/dcshadow_attack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index 096a37a643..a1f4e2c5fa 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -1,5 +1,5 @@ name: DCShadow Attack -id: b500b64d-5330-4c92-9581-e4c3f0728621 +id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 version: 1 date: '2022-09-02' author: Dean Luxton From 24c2b5cf820ea9b4b617e5dad6d15739bd24fa82 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 2 Sep 2022 13:57:00 +1000 Subject: [PATCH 06/90] Adding DCShadow detection --- detections/endpoint/dcshadow_attack.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index a1f4e2c5fa..12ed47ef0b 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -6,7 +6,7 @@ author: Dean Luxton type: TTP datamodel: [] description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. -search: "```XML-Wineventlog Detection```\n`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\ +search: "`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\ \ (AttributeValue=\"GC/*\" OR AttributeValue=\"E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\ )\n| replace \"%%14674\" with \"Value Added\", \"%%14675\" with \"Value Deleted\"\ \ in OperationType\n| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType)\ @@ -28,7 +28,7 @@ search: "```XML-Wineventlog Detection```\n`wineventlog_security` EventCode=5136 \ DN, Action, signature, status, src, Logon_ID, Logon_GUID\n| eval firstEvent=strftime(firstEvent,\ \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\ )``` | `dcshadow_attack_filter`" -how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to  `Write All Properties` applied to the domain root and all descendant objects. +how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting Audit Directory Services Changes within DS Access needs to be enabled, alongside a SACL for everybody to Write All Properties applied to the domain root and all descendant objects. known_false_positives: None. references: - https://www.dcshadow.com/ @@ -61,7 +61,7 @@ tags: role: - Victim - name: src - type: IP + type: IP Address role: - Attacker product: From 7692e55d9d8a13f22fb50e22386424a6cff3267a Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Wed, 7 Sep 2022 17:05:40 +1000 Subject: [PATCH 07/90] DCShadow Detection --- detections/endpoint/dcshadow_attack.yml | 29 ++++++------------------- 1 file changed, 7 insertions(+), 22 deletions(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index 12ed47ef0b..e0dec7e757 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -6,28 +6,13 @@ author: Dean Luxton type: TTP datamodel: [] description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. -search: "`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName\ - \ (AttributeValue=\"GC/*\" OR AttributeValue=\"E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\ - )\n| replace \"%%14674\" with \"Value Added\", \"%%14675\" with \"Value Deleted\"\ - \ in OperationType\n| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType)\ - \ as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN,\ - \ Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer Logon_ID [|\ - \ search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID\ - \ src_ip as src]\n| table firstEvent, latestEvent, duration, src_nt_domain, src_user,\ - \ Computer, ObjectDN, Action, signature, src, Logon_ID\n| eval firstEvent=strftime(firstEvent,\ - \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\ - )\n\n```Non-XML Wineventlog Detection\n`wineventlog_security` EventCode=5136 LDAP_Display_Name=servicePrincipalName\n\ - (Value=\"*GC/*\" OR Value=\"*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\")\n| stats\ - \ min(_time) as firstEvent max(_time) as latestEvent values(eval(mvfilter(match(Type,\"\ - Value\")))) as Action range(_time) as duration by Account_Domain, Account_Name,\ - \ ComputerName, DN, Logon_ID, signature\n| where mvcount(Action) >1 \n| join type=outer\ - \ Logon_ID [| search index=win EventCode=4624 | eval Logon_ID=if(mvcount(Logon_ID)>1,mvindex(Logon_ID,1),'Logon_ID'),\ - \ Account_Domain=if(mvcount(Account_Domain)>1,mvindex(Account_Domain,1),'Account_Domain'),\ - \ Account_Name=if(mvcount(Account_Name)>1,mvindex(Account_Name,1),'Account_Name')]\n\ - | table firstEvent, latestEvent, duration, Account_Domain, Account_Name, ComputerName,\ - \ DN, Action, signature, status, src, Logon_ID, Logon_GUID\n| eval firstEvent=strftime(firstEvent,\ - \ \"%Y-%m-%d %H:%M:%S\"), latestEvent=strftime(latestEvent, \"%Y-%m-%d %H:%M:%S\"\ - )``` | `dcshadow_attack_filter`" +search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*") +| replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType +| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature +| where mvcount(Action) >1 +| join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID src_ip as src] +| table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID +| eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S")' how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting Audit Directory Services Changes within DS Access needs to be enabled, alongside a SACL for everybody to Write All Properties applied to the domain root and all descendant objects. known_false_positives: None. references: From 1d6c0d6350339e152247188cbc2a82852abf3638 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 14:29:17 +1000 Subject: [PATCH 08/90] DCShadow Detection --- detections/endpoint/dcshadow_attack.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index e0dec7e757..0f138a4c8c 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -12,8 +12,12 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | where mvcount(Action) >1 | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID src_ip as src] | table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID -| eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S")' -how_to_implement: To successfully implement this search, you need to be ingesting eventcode 5136. The Advanced Security Audit policy setting Audit Directory Services Changes within DS Access needs to be enabled, alongside a SACL for everybody to Write All Properties applied to the domain root and all descendant objects. +| eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") +| `dcshadow_attack_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. +The Advanced Security Audit policy setting `Audit Directory Services Changes` within +`DS Access` needs to be enabled, alongside a SACL for +`everybody` to `Write All Properties` applied to the domain root and all descendant objects. known_false_positives: None. references: - https://www.dcshadow.com/ From 56ddcbc15c09697a693681ce753aa39d91418346 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 14:33:53 +1000 Subject: [PATCH 09/90] DCShadow Detection --- detections/endpoint/dcshadow_attack.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index 0f138a4c8c..14f197b1e3 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -15,9 +15,9 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") | `dcshadow_attack_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. -The Advanced Security Audit policy setting `Audit Directory Services Changes` within -`DS Access` needs to be enabled, alongside a SACL for -`everybody` to `Write All Properties` applied to the domain root and all descendant objects. + The Advanced Security Audit policy setting `Audit Directory Services Changes` within + `DS Access` needs to be enabled, alongside a SACL for + `everybody` to `Write All Properties` applied to the domain root and all descendant objects. known_false_positives: None. references: - https://www.dcshadow.com/ From ab1ba478ae6a0b070a3042034197641b17aa4339 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 14:41:16 +1000 Subject: [PATCH 10/90] DCShadow Detection --- detections/endpoint/dcshadow_attack.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index 14f197b1e3..e3af3f6cab 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -14,10 +14,10 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") | `dcshadow_attack_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. - The Advanced Security Audit policy setting `Audit Directory Services Changes` within - `DS Access` needs to be enabled, alongside a SACL for - `everybody` to `Write All Properties` applied to the domain root and all descendant objects. +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled, alongside a SACL for `everybody` to + `Write All Properties` applied to the domain root and all descendant objects. known_false_positives: None. references: - https://www.dcshadow.com/ From f9c3a86423278d8c75e28148b41461774e99d556 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 15:49:03 +1000 Subject: [PATCH 11/90] DCShadow Detection --- tests/endpoint/dcshadow_attack.test.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/dcshadow_attack.test.yml index 04c3d4f9d4..030a27d2a9 100644 --- a/tests/endpoint/dcshadow_attack.test.yml +++ b/tests/endpoint/dcshadow_attack.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: windows-security-xml.log + data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog update_timestamp: true From 925b1eb2cd4ce76706bfd5648652b14f5560a33f Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 16:08:36 +1000 Subject: [PATCH 12/90] DCShadow Detection --- tests/endpoint/dcshadow_attack.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/dcshadow_attack.test.yml index 030a27d2a9..ce3e9308a7 100644 --- a/tests/endpoint/dcshadow_attack.test.yml +++ b/tests/endpoint/dcshadow_attack.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: windows-security-xml.log - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog update_timestamp: true From 29da4843657e388a89c703810c74748bf1c40057 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 18:14:24 +1000 Subject: [PATCH 13/90] Adding DCSync Attack --- detections/endpoint/dcsync_attack.yml | 91 +++++++++++++++++++++++++++ tests/endpoint/dcsync_attack.test.yml | 13 ++++ 2 files changed, 104 insertions(+) create mode 100644 detections/endpoint/dcsync_attack.yml create mode 100644 tests/endpoint/dcsync_attack.test.yml diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml new file mode 100644 index 0000000000..78e328dac5 --- /dev/null +++ b/detections/endpoint/dcsync_attack.yml @@ -0,0 +1,91 @@ +name: DCSync Attack +id: 51307514-1236-49f6-8686-d46d93cc2821 +version: 1 +date: '2022-09-08' +author: Dean Luxton +type: TTP +datamodel: [] +description: When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. + Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain. + This alert detects when a handle to domainDNS is opened with the necessary replication permissions. +search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", + "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", + "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") + + | stats min(_time) as firstEvent, max(_time) as latestEvent, range(_time) as duration + count by AccessMask, SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, + ObjectServer, ObjectType, OperationType, status + + | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename + TargetLogonId as Logon_ID, TargetDomainName as domain] + + | table firstEvent, latestEvent, duration, AccessMask, domain, user, Computer, Logon_ID, + ObjectName, ObjectServer, ObjectType, OperationType, status, src_ip, Logon_ID + + | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, + "%Y-%m-%d %H:%M:%S") | `dcsync_attack_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `4662`. + The Advanced Security Audit policy settings `Audit Directory Services Access` + within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root + and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` + auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and + `Replicating Directory Changes In Filtered Set` + + If genuine DC activity triggers this detection within your environment, look to tune out the + domain controller computer accounts using asset and identities. +known_false_positives: A genuine domain controller promotion event will trigger this alert. +references: +- https://adsecurity.org/?p=1729 +- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: DCSync Attack Detected from $src$ + mitre_attack_id: + - T1003.006 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectType + - Properties + - AccessMask + - SubjectDomainName + - SubjectUserName + - Computer + - Logon_ID + - ObjectName + - ObjectServer + - ObjectType + - OperationType + - status + risk_score: 80 + security_domain: endpoint diff --git a/tests/endpoint/dcsync_attack.test.yml b/tests/endpoint/dcsync_attack.test.yml new file mode 100644 index 0000000000..afa44ecda5 --- /dev/null +++ b/tests/endpoint/dcsync_attack.test.yml @@ -0,0 +1,13 @@ +name: DCSync Attack Unit Test +tests: +- name: DCSync Attack + file: endpoint/dcsync_attack.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true From 32dd94c6ef8a61caa9d25e65f6292fef17201605 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 18:17:58 +1000 Subject: [PATCH 14/90] Adding DCSync Attack --- detections/endpoint/dcsync_attack.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index 78e328dac5..79c422f953 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -40,6 +40,7 @@ references: tags: analytic_story: - Domain Controller Attacks + - Credential Dumping asset_type: Endpoint cis20: - CIS 3 @@ -60,7 +61,7 @@ tags: nist: - DE.CM observable: - - name: src_user + - name: src_user type: User role: - Victim From 0b0b19f10d2fe3f9f99c43061e11bc54c699eec8 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 18:39:38 +1000 Subject: [PATCH 15/90] Adding Rogue DC Detection --- detections/endpoint/dcsync_attack.yml | 5 -- .../network/rogue_dc_network_activity.yml | 61 +++++++++++++++++++ .../rogue_dc_network_activity.test.yml | 13 ++++ 3 files changed, 74 insertions(+), 5 deletions(-) create mode 100644 detections/network/rogue_dc_network_activity.yml create mode 100644 tests/network/rogue_dc_network_activity.test.yml diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index 79c422f953..1a2472d820 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -11,17 +11,13 @@ description: When a domain controller receives a replication request, the user a search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") - | stats min(_time) as firstEvent, max(_time) as latestEvent, range(_time) as duration count by AccessMask, SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status - | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID, TargetDomainName as domain] - | table firstEvent, latestEvent, duration, AccessMask, domain, user, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status, src_ip, Logon_ID - | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") | `dcsync_attack_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `4662`. @@ -30,7 +26,6 @@ how_to_implement: To successfully implement this search, you ned to be ingesting and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes In Filtered Set` - If genuine DC activity triggers this detection within your environment, look to tune out the domain controller computer accounts using asset and identities. known_false_positives: A genuine domain controller promotion event will trigger this alert. diff --git a/detections/network/rogue_dc_network_activity.yml b/detections/network/rogue_dc_network_activity.yml new file mode 100644 index 0000000000..1e774eadcd --- /dev/null +++ b/detections/network/rogue_dc_network_activity.yml @@ -0,0 +1,61 @@ +name: Rogue DC Network Activity +id: c4aeeeef-da7f-4338-b3ba-553cbcbe2138 +version: 1 +date: '2022-09-08' +author: Dean Luxton +type: TTP +datamodel: [] +description: This detection is looking at zeek wiredata for specific replication RPC calls being performed from a device which is not a domain controller. + If you would like to capture these RPC calls using Splunk Stream, please vote for my idea here https://ideas.splunk.com/ideas/APPSID-I-619 ;) +search: 'sourcetype=bro:dce_rpc:json DrsReplicaAdd OR DRSGetNCChanges + + | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller") + + | fillnull value="Unknown" src_category, dest_category + + | table _time endpoint operation src src_category dest dest_category | `rogue_dc_network_activity_filter`' +how_to_implement: Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities. +known_false_positives: None. +references: +- https://adsecurity.org/?p=1729 +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Network + - Stage:Defense Evasion + dataset: + - https://github.com/splunk/attack_data/blob/master/datasets/attack_techniques/T1207/mimikatz/zeek-dce_rpc.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Rogue DC Activity Detected from $src_category$ device $src$ to $dest$ ($dest_category$) + mitre_attack_id: + - T1207 + nist: + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: dest + type: IP Address + role: + - Victim +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - src + - dest + risk_score: 100 + security_domain: network diff --git a/tests/network/rogue_dc_network_activity.test.yml b/tests/network/rogue_dc_network_activity.test.yml new file mode 100644 index 0000000000..71e9d913f1 --- /dev/null +++ b/tests/network/rogue_dc_network_activity.test.yml @@ -0,0 +1,13 @@ +name: Rogue DC Network Activity Unit Test +tests: +- name: Rogue DC Network Activity + file: network/rogue_dc_network_activity.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: zeek-dce_rpc.log + data: https://github.com/splunk/attack_data/blob/master/datasets/attack_techniques/T1207/mimikatz/zeek-dce_rpc.log + source: /opt/zeek/logs/current/dce_rpc.log + sourcetype: bro:dce_rpc:json + update_timestamp: true From 1441cca7907d82a6620c338490e104fd8419ab11 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 18:44:09 +1000 Subject: [PATCH 16/90] Adding Rogue DC Detection --- detections/network/rogue_dc_network_activity.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/network/rogue_dc_network_activity.yml b/detections/network/rogue_dc_network_activity.yml index 1e774eadcd..e47487cb84 100644 --- a/detections/network/rogue_dc_network_activity.yml +++ b/detections/network/rogue_dc_network_activity.yml @@ -49,7 +49,7 @@ tags: type: IP Address role: - Victim -product: + product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud From 66990b409d978e017feb741de9bdc4df54fad8b5 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 19:39:52 +1000 Subject: [PATCH 17/90] Adding Rogue DC Detection --- detections/network/rogue_dc_network_activity.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/network/rogue_dc_network_activity.yml b/detections/network/rogue_dc_network_activity.yml index e47487cb84..4ae8851eca 100644 --- a/detections/network/rogue_dc_network_activity.yml +++ b/detections/network/rogue_dc_network_activity.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: This detection is looking at zeek wiredata for specific replication RPC calls being performed from a device which is not a domain controller. If you would like to capture these RPC calls using Splunk Stream, please vote for my idea here https://ideas.splunk.com/ideas/APPSID-I-619 ;) -search: 'sourcetype=bro:dce_rpc:json DrsReplicaAdd OR DRSGetNCChanges +search: '`zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller") @@ -28,7 +28,7 @@ tags: - CIS 16 confidence: 100 context: - - Source:Network + - Source:IPS - Stage:Defense Evasion dataset: - https://github.com/splunk/attack_data/blob/master/datasets/attack_techniques/T1207/mimikatz/zeek-dce_rpc.log From 8ccec66c079d633aa1175230aa990e9896b51783 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 19:43:23 +1000 Subject: [PATCH 18/90] Adding Rogue DC Detection --- detections/network/rogue_dc_network_activity.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/detections/network/rogue_dc_network_activity.yml b/detections/network/rogue_dc_network_activity.yml index 4ae8851eca..6be5221d51 100644 --- a/detections/network/rogue_dc_network_activity.yml +++ b/detections/network/rogue_dc_network_activity.yml @@ -8,11 +8,8 @@ datamodel: [] description: This detection is looking at zeek wiredata for specific replication RPC calls being performed from a device which is not a domain controller. If you would like to capture these RPC calls using Splunk Stream, please vote for my idea here https://ideas.splunk.com/ideas/APPSID-I-619 ;) search: '`zeek_rpc` DrsReplicaAdd OR DRSGetNCChanges - | where NOT (dest_category="Domain Controller") OR NOT (src_category="Domain Controller") - - | fillnull value="Unknown" src_category, dest_category - + | fillnull value="Unknown" src_category, dest_category | table _time endpoint operation src src_category dest dest_category | `rogue_dc_network_activity_filter`' how_to_implement: Run zeek on domain controllers to capture the DCE RPC calls, ensure the domain controller categories are defined in Assets and Identities. known_false_positives: None. From 3d2301f1613b9957c6596f3e3b811c7b1854f9e8 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 20:13:10 +1000 Subject: [PATCH 19/90] Adding DSRM Passwod Reset --- detections/endpoint/dcsync_attack.yml | 3 +- detections/endpoint/dsrm_password_reset.yml | 66 +++++++++++++++++++++ tests/endpoint/dsrm_password_reset.test.yml | 13 ++++ 3 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/dsrm_password_reset.yml create mode 100644 tests/endpoint/dsrm_password_reset.test.yml diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index 1a2472d820..37e843acf8 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -44,7 +44,8 @@ tags: confidence: 80 context: - Source:Endpoint - - Stage:Defense Evasion + - Source:AD + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log impact: 100 diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml new file mode 100644 index 0000000000..eb29b0161f --- /dev/null +++ b/detections/endpoint/dsrm_password_reset.yml @@ -0,0 +1,66 @@ +name: DSRM Password Reset +id: d1ab841c-36a6-46cf-b50f-b2b04b31182a +version: 1 +date: '2022-09-08' +author: Dean Luxton +type: TTP +datamodel: +- Change +description: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode) + account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be + used in the same way as a local administrator account. This detection is looking for any password reset attempts against that account. +search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Change + where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to + set the Directory Services Restore Mode administrator password" by All_Changes.action + All_Changes.dest All_Changes.src All_Changes.user + | `drop_dm_object_name(All_Changes)` | `dsrm_password_reset_filter`' +how_to_implement: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode) + account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be + used in the same way as a local administrator account. This detection is looking for any password reset attempts against that account. +known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. +references: +- https://adsecurity.org/?p=1714 +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: DSRM Account Password was reset on $dest$ by $user$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - All_Changes.result_id + - All_Changes.result + - All_Changes.action + - All_Changes.dest + - All_Changes.src + - All_Changes.user + risk_score: 100 + security_domain: endpoint diff --git a/tests/endpoint/dsrm_password_reset.test.yml b/tests/endpoint/dsrm_password_reset.test.yml new file mode 100644 index 0000000000..348aa798c3 --- /dev/null +++ b/tests/endpoint/dsrm_password_reset.test.yml @@ -0,0 +1,13 @@ +name: DSRM Password Reset Unit Test +tests: +- name: DSRM Password Reset + file: endpoint/dsrm_password_reset.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true From 3399bc4288baacceea48b1bde71d4e5d2a7f51f0 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 8 Sep 2022 20:45:45 +1000 Subject: [PATCH 20/90] Adding DSRM Account Changes --- detections/endpoint/dsrm_account_changes.yml | 77 ++++++++++++++++++++ detections/endpoint/dsrm_password_reset.yml | 2 +- tests/endpoint/dsrm_account_changes.test.yml | 13 ++++ 3 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/dsrm_account_changes.yml create mode 100644 tests/endpoint/dsrm_account_changes.test.yml diff --git a/detections/endpoint/dsrm_account_changes.yml b/detections/endpoint/dsrm_account_changes.yml new file mode 100644 index 0000000000..9294562e8d --- /dev/null +++ b/detections/endpoint/dsrm_account_changes.yml @@ -0,0 +1,77 @@ +name: DSRM Account Changes +id: 08cb291e-ea77-48e8-a95a-0799319bf056 +version: 1 +date: '2022-09-08' +author: Dean Luxton +type: TTP +datamodel: +- Endpoint +description: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode) + account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be + used in the same way as a local administrator account. This detection is looking for alterations to the behaviour + of the account via registry. +search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry + where Registry.registry_path= "*\\System\\CurrentControlSet\\Control\\Lsa\\DSRMAdminLogonBehavior" + Registry.registry_value_data IN ("*1","*2") by Registry.action Registry.registry_path + Registry.registry_value_data Registry.registry_value_type Registry.process_guid + | `drop_dm_object_name(Registry)` + | join type=outer process_guid [| tstats `security_content_summariesonly` count + FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name Processes.process + Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)`] + | table _time action dest user parent_process_name parent_process process_name process + process_guid registry_path registry_value_data registry_value_type | `dsrm_account_changes_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Disaster recovery events. +references: +- https://adsecurity.org/?p=1714 +tags: + analytic_story: + - Domain Controller Attacks + - Windows Registry Abuse + - Windows Persistence Techniques + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: DSRM Account Changes Initiated on $dest$ by $user$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_value_data + - Registry.registry_path + - Registry.dest + - Registry.user + risk_score: 100 + security_domain: endpoint diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml index eb29b0161f..4627c96c13 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/dsrm_password_reset.yml @@ -31,7 +31,7 @@ tags: confidence: 100 context: - Source:Endpoint - - Stage:Defense Evasion + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml.log impact: 100 diff --git a/tests/endpoint/dsrm_account_changes.test.yml b/tests/endpoint/dsrm_account_changes.test.yml new file mode 100644 index 0000000000..b4a3c000e9 --- /dev/null +++ b/tests/endpoint/dsrm_account_changes.test.yml @@ -0,0 +1,13 @@ +name: DSRM Account Changes Unit Test +tests: +- name: DSRM Account Changes + file: endpoint/dsrm_account_changes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 81f64410c78d3f7b8d9137702c22759545db2d19 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 9 Sep 2022 10:08:35 +1000 Subject: [PATCH 21/90] Adding SID History Abuse Detection --- .../active_directory_sid_history_abuse.yml | 73 +++++++++++++++++++ .../rogue_dc_network_activity.yml | 0 ...ctive_directory_sid_history_abuse.test.yml | 13 ++++ .../rogue_dc_network_activity.test.yml | 0 4 files changed, 86 insertions(+) create mode 100644 detections/endpoint/active_directory_sid_history_abuse.yml rename detections/{network => experimental}/rogue_dc_network_activity.yml (100%) create mode 100644 tests/endpoint/active_directory_sid_history_abuse.test.yml rename tests/{network => experimental}/rogue_dc_network_activity.test.yml (100%) diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/active_directory_sid_history_abuse.yml new file mode 100644 index 0000000000..a916088b75 --- /dev/null +++ b/detections/endpoint/active_directory_sid_history_abuse.yml @@ -0,0 +1,73 @@ +name: Active Directory SID History Abuse +id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d +version: 1 +date: '2022-09-09' +author: Dean Luxton +type: TTP +datamodel: [] +description: The SID history AD attribute allows users to inherit permissions from a separate AD account. Initially developed for access + continuity when migrating domains, the attribute can also be applied for two objects within the same domain. Enabling a stealthy way + for a user or computer object to be a member of a privileged group without any noisy group membership changes. This detection looks for + changes to user or computer objects with the addition of the SID History attribute - yes computer accounts too. + Working with SID Resolution enabled or disabled, written for XML-Wineventlog. +search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory + IN ("%%1793", -) + | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" + | rex field=TargetSid "^(?P.*)(\-|\\\)" + | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName + | rename TargetSid as userSid + | table _time action status host user userSid SidHistory Logon_ID src_user | `active_directory_sid_history_abuse_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting eventcodes + `4738` and `4742`. The Advanced Security Audit policy settings + `Audit User Account Management` and `Audit Computer Account Management` + within `Account Management` need to be enabled. +known_false_positives: Unknown +references: +- https://adsecurity.org/?p=1772 +tags: + analytic_story: + - Domain Controller Attacks + - Windows Persistence Techniques + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 90 + context: + - Source:AD + - Stage:Persistence + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Active Directory SID History Attribute was added to $user$ by $src_user$ + mitre_attack_id: + - T1134.005 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - SidHistory + - TargetSid + - user + - src_user + - Logon_ID + risk_score: 90 + security_domain: endpoint diff --git a/detections/network/rogue_dc_network_activity.yml b/detections/experimental/rogue_dc_network_activity.yml similarity index 100% rename from detections/network/rogue_dc_network_activity.yml rename to detections/experimental/rogue_dc_network_activity.yml diff --git a/tests/endpoint/active_directory_sid_history_abuse.test.yml b/tests/endpoint/active_directory_sid_history_abuse.test.yml new file mode 100644 index 0000000000..547fe95019 --- /dev/null +++ b/tests/endpoint/active_directory_sid_history_abuse.test.yml @@ -0,0 +1,13 @@ +name: Active Directory SID History Abuse Unit Test +tests: +- name: Active Directory SID History Abuse + file: endpoint/active_directory_sid_history_abuse.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/tests/network/rogue_dc_network_activity.test.yml b/tests/experimental/rogue_dc_network_activity.test.yml similarity index 100% rename from tests/network/rogue_dc_network_activity.test.yml rename to tests/experimental/rogue_dc_network_activity.test.yml From 9486fd841910a177999f50175e3ca39e86b59812 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 9 Sep 2022 10:43:29 +1000 Subject: [PATCH 22/90] CICD Magic do your thing --- detections/endpoint/active_directory_sid_history_abuse.yml | 2 ++ detections/endpoint/dcsync_attack.yml | 1 + detections/endpoint/dsrm_password_reset.yml | 1 + 3 files changed, 4 insertions(+) diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/active_directory_sid_history_abuse.yml index a916088b75..6c6417c22c 100644 --- a/detections/endpoint/active_directory_sid_history_abuse.yml +++ b/detections/endpoint/active_directory_sid_history_abuse.yml @@ -46,6 +46,7 @@ tags: message: Active Directory SID History Attribute was added to $user$ by $src_user$ mitre_attack_id: - T1134.005 + - T1134 nist: - DE.CM observable: @@ -66,6 +67,7 @@ tags: - EventCode - SidHistory - TargetSid + - TargetDomainName - user - src_user - Logon_ID diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index 37e843acf8..1e072c4b17 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -54,6 +54,7 @@ tags: message: DCSync Attack Detected from $src$ mitre_attack_id: - T1003.006 + - T1003 nist: - DE.CM observable: diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml index 4627c96c13..46d67fd1e8 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/dsrm_password_reset.yml @@ -56,6 +56,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - _time - All_Changes.result_id - All_Changes.result - All_Changes.action From d5f9b5655234122413d7605103e8393edd8d81a2 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 9 Sep 2022 11:44:59 +1000 Subject: [PATCH 23/90] CICD Magic do your thing --- .../endpoint/active_directory_sid_history_abuse.yml | 9 +++++---- detections/endpoint/dcshadow_attack.yml | 5 ++--- detections/endpoint/dcsync_attack.yml | 5 ++--- detections/endpoint/dsrm_account_changes.yml | 4 +--- detections/endpoint/dsrm_password_reset.yml | 6 ++---- detections/experimental/rogue_dc_network_activity.yml | 5 ++--- 6 files changed, 14 insertions(+), 20 deletions(-) diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/active_directory_sid_history_abuse.yml index 6c6417c22c..f0b36b713d 100644 --- a/detections/endpoint/active_directory_sid_history_abuse.yml +++ b/detections/endpoint/active_directory_sid_history_abuse.yml @@ -15,8 +15,9 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" | rex field=TargetSid "^(?P.*)(\-|\\\)" | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName - | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user | `active_directory_sid_history_abuse_filter`' + | rename TargetSid as userSid, TargetDomainName as userDomainName + | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user + | `active_directory_sid_history_abuse_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` @@ -30,8 +31,8 @@ tags: - Windows Persistence Techniques asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 + - CIS 4 + - CIS 6 - CIS 16 confidence: 90 context: diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index e3af3f6cab..bdd98c8cc3 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -27,9 +27,8 @@ tags: - Domain Controller Attacks asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 - - CIS 16 + - CIS 4 + - CIS 6 confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index 1e072c4b17..ed3fb19369 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -38,9 +38,8 @@ tags: - Credential Dumping asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 - - CIS 16 + - CIS 4 + - CIS 6 confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/dsrm_account_changes.yml b/detections/endpoint/dsrm_account_changes.yml index 9294562e8d..26664b08a8 100644 --- a/detections/endpoint/dsrm_account_changes.yml +++ b/detections/endpoint/dsrm_account_changes.yml @@ -37,9 +37,7 @@ tags: - Windows Persistence Techniques asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 - - CIS 16 + - CIS 6 confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml index 46d67fd1e8..35f20b84e3 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/dsrm_password_reset.yml @@ -12,7 +12,7 @@ description: Aside from being used to promote genuine domain controllers, the DS search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Change where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to set the Directory Services Restore Mode administrator password" by All_Changes.action - All_Changes.dest All_Changes.src All_Changes.user + All_Changes.result_id, All_Changes.result, All_Changes.dest, All_Changes.src, All_Changes.user | `drop_dm_object_name(All_Changes)` | `dsrm_password_reset_filter`' how_to_implement: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode) account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be @@ -25,9 +25,7 @@ tags: - Domain Controller Attacks asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 - - CIS 16 + - CIS 6 confidence: 100 context: - Source:Endpoint diff --git a/detections/experimental/rogue_dc_network_activity.yml b/detections/experimental/rogue_dc_network_activity.yml index 6be5221d51..bc46c7e97d 100644 --- a/detections/experimental/rogue_dc_network_activity.yml +++ b/detections/experimental/rogue_dc_network_activity.yml @@ -20,9 +20,8 @@ tags: - Domain Controller Attacks asset_type: Endpoint cis20: - - CIS 3 - - CIS 5 - - CIS 16 + - CIS 4 + - CIS 6 confidence: 100 context: - Source:IPS From c46d7e494e11832c84b5476d594cc0e87fd8268b Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Sat, 10 Sep 2022 15:16:37 +1000 Subject: [PATCH 24/90] Adding Detection for Disabling LSA defences via Reg --- ...curity_authority_defences_via_registry.yml | 76 +++++++++++++++++++ ...y_authority_defences_via_registry.test.yml | 13 ++++ 2 files changed, 89 insertions(+) create mode 100644 detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml create mode 100644 tests/endpoint/disabling_windows_local_security_authority_defences_via_registry.test.yml diff --git a/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml new file mode 100644 index 0000000000..f58816a812 --- /dev/null +++ b/detections/endpoint/disabling_windows_local_security_authority_defences_via_registry.yml @@ -0,0 +1,76 @@ +name: Disabling Windows Local Security Authority Defences via Registry +id: 45cd08f8-a2c9-4f4e-baab-e1a0c624b0ab +version: 1 +date: '2022-09-09' +author: Dean Luxton +type: TTP +datamodel: +- Endpoint +description: This detection looks for the deletion of registry keys which disable LSA protection and MS Defender Device Guard. +search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Endpoint.Registry + where Registry.registry_path IN ("*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\LsaCfgFlags", + "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*", "*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL") + Registry.action IN (deleted, unknown) by Registry.action Registry.registry_path + Registry.process_guid + | `drop_dm_object_name(Registry)` + | join type=outer process_guid [| tstats `security_content_summariesonly` count + FROM datamodel=Endpoint.Processes by Processes.user Processes.process_name Processes.process + Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid + | `drop_dm_object_name(Processes)`] + | table _time action dest user parent_process_name parent_process process_name process + process_guid registry_path | `disabling_windows_local_security_authority_defences_via_registry_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: Potential to be triggered by an administrator disabling protections for troubleshooting purposes. +references: +- https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection +- https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage +tags: + analytic_story: + - Windows Defence Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + cis20: + - CIS 5 + - CIS 6 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_lsa_protection/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_credential_guard/windows-sysmon.log + impact: 60 + kill_chain_phases: + - Actions on Objectives + message: An attempt to disable Windows LSA defences was detected on $dest$. The reg key $registry_path$ was deleted by $user$. + mitre_attack_id: + - T1556 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.action + - Registry.registry_path + - Registry.dest + - Registry.user + risk_score: 60 + security_domain: endpoint diff --git a/tests/endpoint/disabling_windows_local_security_authority_defences_via_registry.test.yml b/tests/endpoint/disabling_windows_local_security_authority_defences_via_registry.test.yml new file mode 100644 index 0000000000..4ca8e90ad4 --- /dev/null +++ b/tests/endpoint/disabling_windows_local_security_authority_defences_via_registry.test.yml @@ -0,0 +1,13 @@ +name: Disabling Windows Local Security Authority Defences via Registry Unit Test +tests: +- name: Disabling Windows Local Security Authority Defences via Registry + file: endpoint/disabling_windows_local_security_authority_defences_via_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/disable_lsa_protection/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From eaa4ab9265838b7508232f7aec73ad8170c80d25 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 18:27:57 +1000 Subject: [PATCH 25/90] Adding Privileged User SID History Detection --- .../ansible/files/props.conf | 2 + .../roles/attack_replay/tasks/main.yml | 3 +- .../ansible/roles/update_escu/tasks/main.yml | 8 +- ...on => test_config_github_actions.json.bak} | 0 .../active_directory_sid_history_abuse.yml | 2 +- detections/endpoint/dsrm_password_reset.yml | 10 +-- ...id_history_privileged_account_addition.yml | 78 +++++++++++++++++++ .../rogue_dc_network_activity.yml | 0 ...story_privileged_account_addition.test.yml | 13 ++++ 9 files changed, 101 insertions(+), 15 deletions(-) create mode 100644 bin/docker_detection_tester/ansible/files/props.conf rename bin/docker_detection_tester/{test_config_github_actions.json => test_config_github_actions.json.bak} (100%) create mode 100644 detections/experimental/active_directory_sid_history_privileged_account_addition.yml rename detections/experimental/{ => network}/rogue_dc_network_activity.yml (100%) create mode 100644 tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml diff --git a/bin/docker_detection_tester/ansible/files/props.conf b/bin/docker_detection_tester/ansible/files/props.conf new file mode 100644 index 0000000000..ede8ee1033 --- /dev/null +++ b/bin/docker_detection_tester/ansible/files/props.conf @@ -0,0 +1,2 @@ +[XmlWinEventLog] +BREAK_ONLY_BEFORE= /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart become: yes - name: restart splunk diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json.bak similarity index 100% rename from bin/docker_detection_tester/test_config_github_actions.json rename to bin/docker_detection_tester/test_config_github_actions.json.bak diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/active_directory_sid_history_abuse.yml index f0b36b713d..6a85348b5a 100644 --- a/detections/endpoint/active_directory_sid_history_abuse.yml +++ b/detections/endpoint/active_directory_sid_history_abuse.yml @@ -18,7 +18,7 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user | `active_directory_sid_history_abuse_filter`' -how_to_implement: To successfully implement this search, you ned to be ingesting eventcodes +how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` within `Account Management` need to be enabled. diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml index 35f20b84e3..c0e568837c 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/dsrm_password_reset.yml @@ -11,12 +11,12 @@ description: Aside from being used to promote genuine domain controllers, the DS used in the same way as a local administrator account. This detection is looking for any password reset attempts against that account. search: '| tstats `security_content_summariesonly` min(_time) as _time from datamodel=Change where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to - set the Directory Services Restore Mode administrator password" by All_Changes.action - All_Changes.result_id, All_Changes.result, All_Changes.dest, All_Changes.src, All_Changes.user + set the Directory Services Restore Mode administrator password" by All_Changes.action, + All_Changes.dest, All_Changes.src, All_Changes.user | `drop_dm_object_name(All_Changes)` | `dsrm_password_reset_filter`' -how_to_implement: Aside from being used to promote genuine domain controllers, the DSRM (Directory Services Restore Mode) - account can be used to persist within a Domain. A DC can be configured to allow the DSRM account to logon & be - used in the same way as a local administrator account. This detection is looking for any password reset attempts against that account. +how_to_implement: To successfully implement this search, you need to be ingesting eventcode + `4794` and have the Advanced Security Audit policy + `Audit User Account Management` within `Account Management` enabled. known_false_positives: Resetting the DSRM password for legitamate reasons, i.e. forgot the password. Disaster recovery. Deploying AD backdoor deliberately. references: - https://adsecurity.org/?p=1714 diff --git a/detections/experimental/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/active_directory_sid_history_privileged_account_addition.yml new file mode 100644 index 0000000000..c08eb3c241 --- /dev/null +++ b/detections/experimental/active_directory_sid_history_privileged_account_addition.yml @@ -0,0 +1,78 @@ +name: Active Directory SID History Privileged Account Addition +id: 6b521149-b91c-43aa-ba97-c2cac59ec830 +version: 1 +date: '2022-09-12' +author: Dean Luxton +type: TTP +datamodel: [] +description: This detection identifies when the SID of a privileged user is added to + the SID History attribute of another user. Useful for tracking SID history abuse + accross multiple domains. This detection leverages the Asset and Identities + framework. See the how to implement section for further details on configuration. +search: "`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory\ + \ IN (\"%%1793\", -) \n| rex field=SidHistory \"(^%{|^)(?P.*?)(}$|$)\"\ + \ \n| eval category=\"privileged\" \n| lookup identity_lookup_expanded category,\ + \ identity as SidHistory OUTPUT identity_tag as match \n| where isnotnull(match)\n\ + | rename TargetSid as userSid \n| table _time action status host user userSid SidHistory\ + \ Logon_ID src_user | `active_directory_sid_history_privileged_account_addition_filter`" +how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN\sAMACountName`) + added to the identity field of your Asset & Identities lookup, along with the + category of privileged for the applicable users. If unsure, a great starting point + is all users with the AdminCount attribute set with the value of 1. + + Also ensure you are ingesting eventcodes 4742 and 4738. + Two advanced audit policies `Audit User Account Management` + and `Audit Computer Account Management` under + `Account Management` are required to generate these event codes. +known_false_positives: Migration of privileged accounts. +references: +- https://adsecurity.org/?p=1772 +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + - CIS 16 + confidence: 900 + context: + - Source:Endpoint + - Source:AD + - Stage:Defense Evasion + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: A Privileged User Account SID History Attribute was added to $user$ by $src_user$ + mitre_attack_id: + - T1134.005 + - T1134 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - SidHistory + - TargetSid + - TargetDomainName + - user + - src_user + - Logon_ID + risk_score: 90 + security_domain: endpoint diff --git a/detections/experimental/rogue_dc_network_activity.yml b/detections/experimental/network/rogue_dc_network_activity.yml similarity index 100% rename from detections/experimental/rogue_dc_network_activity.yml rename to detections/experimental/network/rogue_dc_network_activity.yml diff --git a/tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml b/tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml new file mode 100644 index 0000000000..a29b46ae0f --- /dev/null +++ b/tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml @@ -0,0 +1,13 @@ +name: Active Directory SID History Privileged Account Addition Unit Test +tests: +- name: Active Directory SID History Privileged Account Addition + file: experimental/active_directory_sid_history_privileged_account_addition.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog + update_timestamp: true From 6a1236f0595643604e53a5a1cd9bfa3b435dab62 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 20:31:11 +1000 Subject: [PATCH 26/90] Adding Privileged User SID History Detection --- .../{ => roles/update_escu}/files/props.conf | 0 .../ansible/roles/update_escu/tasks/main.yml | 13 ++ .../test_config_github_actions.json | 124 ++++++++++++++++++ 3 files changed, 137 insertions(+) rename bin/docker_detection_tester/ansible/{ => roles/update_escu}/files/props.conf (100%) create mode 100644 bin/docker_detection_tester/test_config_github_actions.json diff --git a/bin/docker_detection_tester/ansible/files/props.conf b/bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf similarity index 100% rename from bin/docker_detection_tester/ansible/files/props.conf rename to bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf diff --git a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml index 4df9fe0bea..10690b5252 100644 --- a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml +++ b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml @@ -14,6 +14,19 @@ group: splunk become: yes +- name: make /opt writetable by splunk + become: true + file: path=/opt/splunk/etc/system/local/ mode=777 + +- name: copy props.conf to fix XMLWinEventlog parsing issue + copy: + src: props.conf + dest: /opt/splunk/etc/system/local/props.conf + owner: splunk + group: splunk + force: yes + become: yes + - name: restart containerized splunk ansible.builtin.shell: echo "[XmlWinEventLog]" > /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart become: yes diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json new file mode 100644 index 0000000000..0872c356ea --- /dev/null +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -0,0 +1,124 @@ +{ + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { + "app_number": 2757, + "app_version": "7.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "4.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "3.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.6.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "URL_TOOLBOX": { + "app_number": 2734, + "app_version": "1.9.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, + "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { + "app_number": 3110, + "app_version": "4.5.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + } + }, + "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", + "commit_hash": null, + "container_tag": "latest", + "detections_list": null, + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": false, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "changes", + "no_interactive_failure": true, + "num_containers": 10, + "persist_security_content": false, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} From d472fbd0d2fdc7e88283a4d1b8279a1fc2865aa1 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 20:53:56 +1000 Subject: [PATCH 27/90] Adding Privileged User SID History Detection --- .../ansible/roles/update_escu/tasks/main.yml | 15 +++++++-------- ...ry_sid_history_privileged_account_addition.yml | 2 +- 2 files changed, 8 insertions(+), 9 deletions(-) rename detections/experimental/{ => endpoint}/active_directory_sid_history_privileged_account_addition.yml (99%) diff --git a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml index 10690b5252..4bccb247e1 100644 --- a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml +++ b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml @@ -16,16 +16,15 @@ - name: make /opt writetable by splunk become: true - file: path=/opt/splunk/etc/system/local/ mode=777 + file: path=/opt/splunk/etc/system/local mode=777 - name: copy props.conf to fix XMLWinEventlog parsing issue - copy: - src: props.conf - dest: /opt/splunk/etc/system/local/props.conf - owner: splunk - group: splunk - force: yes - become: yes + become: true + command: "echo '[XmlWinEventLog]' > /opt/splunk/etc/system/local/props.conf" + +- name: copy props.conf to fix XMLWinEventlog parsing issue + become: true + command: "echo 'BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf" - name: restart containerized splunk ansible.builtin.shell: echo "[XmlWinEventLog]" > /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart diff --git a/detections/experimental/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml similarity index 99% rename from detections/experimental/active_directory_sid_history_privileged_account_addition.yml rename to detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml index c08eb3c241..cda2f9c572 100644 --- a/detections/experimental/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -35,7 +35,7 @@ tags: - CIS 4 - CIS 6 - CIS 16 - confidence: 900 + confidence: 90 context: - Source:Endpoint - Source:AD From c3141193418fe1ec377eaee4382995640d3e6a32 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 21:05:45 +1000 Subject: [PATCH 28/90] Adding Privileged User SID History Detection --- .../roles/update_escu/files/props.conf | 2 - .../ansible/roles/update_escu/tasks/main.yml | 12 --- ...id_history_privileged_account_addition.yml | 77 +++++++++++++++++++ ...id_history_privileged_account_addition.yml | 1 - 4 files changed, 77 insertions(+), 15 deletions(-) delete mode 100644 bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf create mode 100644 detections/endpoint/active_directory_sid_history_privileged_account_addition.yml diff --git a/bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf b/bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf deleted file mode 100644 index ede8ee1033..0000000000 --- a/bin/docker_detection_tester/ansible/roles/update_escu/files/props.conf +++ /dev/null @@ -1,2 +0,0 @@ -[XmlWinEventLog] -BREAK_ONLY_BEFORE= /opt/splunk/etc/system/local/props.conf" - -- name: copy props.conf to fix XMLWinEventlog parsing issue - become: true - command: "echo 'BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf" - - name: restart containerized splunk ansible.builtin.shell: echo "[XmlWinEventLog]" > /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart become: yes diff --git a/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml new file mode 100644 index 0000000000..3d1372242c --- /dev/null +++ b/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -0,0 +1,77 @@ +name: Active Directory SID History Privileged Account Addition +id: 6b521149-b91c-43aa-ba97-c2cac59ec830 +version: 1 +date: '2022-09-12' +author: Dean Luxton +type: TTP +datamodel: [] +description: This detection identifies when the SID of a privileged user is added to + the SID History attribute of another user. Useful for tracking SID history abuse + accross multiple domains. This detection leverages the Asset and Identities + framework. See the how to implement section for further details on configuration. +search: "`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory\ + \ IN (\"%%1793\", -) \n| rex field=SidHistory \"(^%{|^)(?P.*?)(}$|$)\"\ + \ \n| eval category=\"privileged\" \n| lookup identity_lookup_expanded category,\ + \ identity as SidHistory OUTPUT identity_tag as match \n| where isnotnull(match)\n\ + | rename TargetSid as userSid \n| table _time action status host user userSid SidHistory\ + \ Logon_ID src_user | `active_directory_sid_history_privileged_account_addition_filter`" +how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN\sAMACountName`) + added to the identity field of your Asset & Identities lookup, along with the + category of privileged for the applicable users. If unsure, a great starting point + is all users with the AdminCount attribute set with the value of 1. + Also ensure you are ingesting eventcodes 4742 and 4738. + Two advanced audit policies `Audit User Account Management` + and `Audit Computer Account Management` under + `Account Management` are required to generate these event codes. +known_false_positives: Migration of privileged accounts. +references: +- https://adsecurity.org/?p=1772 +tags: + analytic_story: + - Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + - CIS 16 + confidence: 90 + context: + - Source:Endpoint + - Source:AD + - Stage:Defense Evasion + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: A Privileged User Account SID History Attribute was added to $user$ by $src_user$ + mitre_attack_id: + - T1134.005 + - T1134 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - SidHistory + - TargetSid + - TargetDomainName + - user + - src_user + - Logon_ID + risk_score: 90 + security_domain: endpoint diff --git a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml index cda2f9c572..3d1372242c 100644 --- a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -19,7 +19,6 @@ how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN added to the identity field of your Asset & Identities lookup, along with the category of privileged for the applicable users. If unsure, a great starting point is all users with the AdminCount attribute set with the value of 1. - Also ensure you are ingesting eventcodes 4742 and 4738. Two advanced audit policies `Audit User Account Management` and `Audit Computer Account Management` under From 65e996fffe8418d31bc78b0f5f7f68cae599aa9d Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 21:31:24 +1000 Subject: [PATCH 29/90] Adding Privileged User SID History Detection --- .../roles/attack_replay/tasks/main.yml | 1 + .../ansible/roles/update_escu/tasks/main.yml | 8 +- ...id_history_privileged_account_addition.yml | 77 ------------------- ...id_history_privileged_account_addition.yml | 28 +++---- 4 files changed, 22 insertions(+), 92 deletions(-) delete mode 100644 detections/endpoint/active_directory_sid_history_privileged_account_addition.yml diff --git a/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml index 298c596064..9f7ff27e72 100644 --- a/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml +++ b/bin/docker_detection_tester/ansible/roles/attack_replay/tasks/main.yml @@ -1,5 +1,6 @@ --- + - name: Upload replay copy: src: ../../../{{ folder_name }}/{{ out }} diff --git a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml index 4df9fe0bea..f076b8d315 100644 --- a/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml +++ b/bin/docker_detection_tester/ansible/roles/update_escu/tasks/main.yml @@ -14,8 +14,14 @@ group: splunk become: yes + - name: restart containerized splunk - ansible.builtin.shell: echo "[XmlWinEventLog]" > /opt/splunk/etc/system/local/props.conf && echo "BREAK_ONLY_BEFORE=> /opt/splunk/etc/system/local/props.conf && /opt/splunk/bin/splunk restart + ansible.builtin.shell: /opt/splunk/bin/splunk restart + become: yes +- name: restart splunk + service: + name: splunkd + state: restarted become: yes - name: restart splunk diff --git a/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml deleted file mode 100644 index 3d1372242c..0000000000 --- a/detections/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ /dev/null @@ -1,77 +0,0 @@ -name: Active Directory SID History Privileged Account Addition -id: 6b521149-b91c-43aa-ba97-c2cac59ec830 -version: 1 -date: '2022-09-12' -author: Dean Luxton -type: TTP -datamodel: [] -description: This detection identifies when the SID of a privileged user is added to - the SID History attribute of another user. Useful for tracking SID history abuse - accross multiple domains. This detection leverages the Asset and Identities - framework. See the how to implement section for further details on configuration. -search: "`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory\ - \ IN (\"%%1793\", -) \n| rex field=SidHistory \"(^%{|^)(?P.*?)(}$|$)\"\ - \ \n| eval category=\"privileged\" \n| lookup identity_lookup_expanded category,\ - \ identity as SidHistory OUTPUT identity_tag as match \n| where isnotnull(match)\n\ - | rename TargetSid as userSid \n| table _time action status host user userSid SidHistory\ - \ Logon_ID src_user | `active_directory_sid_history_privileged_account_addition_filter`" -how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN\sAMACountName`) - added to the identity field of your Asset & Identities lookup, along with the - category of privileged for the applicable users. If unsure, a great starting point - is all users with the AdminCount attribute set with the value of 1. - Also ensure you are ingesting eventcodes 4742 and 4738. - Two advanced audit policies `Audit User Account Management` - and `Audit Computer Account Management` under - `Account Management` are required to generate these event codes. -known_false_positives: Migration of privileged accounts. -references: -- https://adsecurity.org/?p=1772 -tags: - analytic_story: - - Domain Controller Attacks - asset_type: Endpoint - cis20: - - CIS 4 - - CIS 6 - - CIS 16 - confidence: 90 - context: - - Source:Endpoint - - Source:AD - - Stage:Defense Evasion - - Stage:Privilege Escalation - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log - impact: 100 - kill_chain_phases: - - Actions on Objectives - message: A Privileged User Account SID History Attribute was added to $user$ by $src_user$ - mitre_attack_id: - - T1134.005 - - T1134 - nist: - - DE.CM - observable: - - name: src_user - type: User - role: - - Victim - - name: user - type: User - role: - - Victim - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - SidHistory - - TargetSid - - TargetDomainName - - user - - src_user - - Logon_ID - risk_score: 90 - security_domain: endpoint diff --git a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml index 3d1372242c..a47b230281 100644 --- a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -8,20 +8,20 @@ datamodel: [] description: This detection identifies when the SID of a privileged user is added to the SID History attribute of another user. Useful for tracking SID history abuse accross multiple domains. This detection leverages the Asset and Identities - framework. See the how to implement section for further details on configuration. -search: "`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory\ - \ IN (\"%%1793\", -) \n| rex field=SidHistory \"(^%{|^)(?P.*?)(}$|$)\"\ - \ \n| eval category=\"privileged\" \n| lookup identity_lookup_expanded category,\ - \ identity as SidHistory OUTPUT identity_tag as match \n| where isnotnull(match)\n\ - | rename TargetSid as userSid \n| table _time action status host user userSid SidHistory\ - \ Logon_ID src_user | `active_directory_sid_history_privileged_account_addition_filter`" -how_to_implement: Ensure you have objectSid & the Down-Level Logon Name (`DOMAIN\sAMACountName`) - added to the identity field of your Asset & Identities lookup, along with the - category of privileged for the applicable users. If unsure, a great starting point - is all users with the AdminCount attribute set with the value of 1. - Also ensure you are ingesting eventcodes 4742 and 4738. - Two advanced audit policies `Audit User Account Management` - and `Audit Computer Account Management` under + framework. See the implemention section for further details on configuration. +search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) + | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" + | eval category="privileged" + | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match + | where isnotnull(match) + | rename TargetSid as userSid + | table _time action status host user userSid SidHistory Logon_ID src_user' +how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` + added to the identity field of your Asset and Identities lookup, along with the + category of privileged for the applicable users. If unsure, users with the AdminCount + attribute set with the value of 1 are great candidates. Also ensure you are + ingesting eventcodes 4742 and 4738. Two advanced audit policies + `Audit User Account Management` and `Audit Computer Account Management` under `Account Management` are required to generate these event codes. known_false_positives: Migration of privileged accounts. references: From f96267405bc935324b9b3f3841005ca65d734dac Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Mon, 12 Sep 2022 21:36:03 +1000 Subject: [PATCH 30/90] Adding Privileged User SID History Detection --- ...ctive_directory_sid_history_privileged_account_addition.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml index a47b230281..beabde37fe 100644 --- a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -15,7 +15,8 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | lookup identity_lookup_expanded category, identity as SidHistory OUTPUT identity_tag as match | where isnotnull(match) | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user' + | table _time action status host user userSid SidHistory Logon_ID src_user + | `active_directory_sid_history_privileged_account_addition_filter`' how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` added to the identity field of your Asset and Identities lookup, along with the category of privileged for the applicable users. If unsure, users with the AdminCount From 5f958fa1e5455b73bdd482f19b75e50f361a1af5 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Wed, 21 Sep 2022 09:02:32 +1000 Subject: [PATCH 31/90] Updating Analytic Story --- stories/windows_domain_controller_attacks.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index aafcb1cf34..9f58a6379a 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -3,9 +3,15 @@ id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco -description: UPDATE_DESCRIPTION -narrative: UPDATE_NARRATIVE -references: [] +description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. +narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. + Featuring attacks which leverage flaws within replication (read MS probably won’t fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. + It is imperative to enable the necessary GPOs and SACLs required - otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. +references: + - https://adsecurity.org/?p=1929 + - https://www.dcshadow.com + - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 + - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer tags: analytic_story: Windows Domain Controller Attacks category: From dee4f1b672e419d2f1bbcffa85bd8351320f8f2e Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Wed, 21 Sep 2022 09:09:34 +1000 Subject: [PATCH 32/90] Updating Analytic Story --- stories/windows_domain_controller_attacks.yml | 2 +- ...e_directory_sid_history_privileged_account_addition.test.yml | 0 .../{ => network}/rogue_dc_network_activity.test.yml | 0 3 files changed, 1 insertion(+), 1 deletion(-) rename tests/experimental/{ => endpoint}/active_directory_sid_history_privileged_account_addition.test.yml (100%) rename tests/experimental/{ => network}/rogue_dc_network_activity.test.yml (100%) diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index 9f58a6379a..14f21fe1c5 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -5,7 +5,7 @@ date: '2022-08-29' author: Dean Luxton, Mauricio Velazco description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. - Featuring attacks which leverage flaws within replication (read MS probably won’t fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. + Featuring attacks which leverage flaws within replication [MS probably won’t fix these any time soon], enabling backdoor accounts and other stealthy persistence techniques. It is imperative to enable the necessary GPOs and SACLs required - otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: - https://adsecurity.org/?p=1929 diff --git a/tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml b/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml similarity index 100% rename from tests/experimental/active_directory_sid_history_privileged_account_addition.test.yml rename to tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml diff --git a/tests/experimental/rogue_dc_network_activity.test.yml b/tests/experimental/network/rogue_dc_network_activity.test.yml similarity index 100% rename from tests/experimental/rogue_dc_network_activity.test.yml rename to tests/experimental/network/rogue_dc_network_activity.test.yml From fe0bcd98806b568fc4b9ddc3cae56525d13f5282 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Wed, 21 Sep 2022 10:53:23 +1000 Subject: [PATCH 33/90] Updating Analytic Story --- stories/windows_domain_controller_attacks.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index 14f21fe1c5..9cf9e2a04b 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -4,9 +4,9 @@ version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. -narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. - Featuring attacks which leverage flaws within replication [MS probably won’t fix these any time soon], enabling backdoor accounts and other stealthy persistence techniques. - It is imperative to enable the necessary GPOs and SACLs required - otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. +narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. + Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. + It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: - https://adsecurity.org/?p=1929 - https://www.dcshadow.com From 98695e754b8fdd3ad3bfba9fc9a7fcc7e2133d18 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 21 Sep 2022 11:48:11 -0700 Subject: [PATCH 34/90] Changed from XmlWinEventLog to xmlwineventlog --- tests/endpoint/active_directory_sid_history_abuse.test.yml | 2 +- tests/endpoint/dcshadow_attack.test.yml | 2 +- tests/endpoint/dcsync_attack.test.yml | 2 +- tests/endpoint/dsrm_password_reset.test.yml | 2 +- ...e_directory_sid_history_privileged_account_addition.test.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/endpoint/active_directory_sid_history_abuse.test.yml b/tests/endpoint/active_directory_sid_history_abuse.test.yml index 547fe95019..96351f997a 100644 --- a/tests/endpoint/active_directory_sid_history_abuse.test.yml +++ b/tests/endpoint/active_directory_sid_history_abuse.test.yml @@ -9,5 +9,5 @@ tests: - file_name: windows-security-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog update_timestamp: true diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/dcshadow_attack.test.yml index ce3e9308a7..77cadc89aa 100644 --- a/tests/endpoint/dcshadow_attack.test.yml +++ b/tests/endpoint/dcshadow_attack.test.yml @@ -9,5 +9,5 @@ tests: - file_name: windows-security-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog update_timestamp: true diff --git a/tests/endpoint/dcsync_attack.test.yml b/tests/endpoint/dcsync_attack.test.yml index afa44ecda5..a40a7e0eb9 100644 --- a/tests/endpoint/dcsync_attack.test.yml +++ b/tests/endpoint/dcsync_attack.test.yml @@ -9,5 +9,5 @@ tests: - file_name: windows-security-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog update_timestamp: true diff --git a/tests/endpoint/dsrm_password_reset.test.yml b/tests/endpoint/dsrm_password_reset.test.yml index 348aa798c3..c962d3acec 100644 --- a/tests/endpoint/dsrm_password_reset.test.yml +++ b/tests/endpoint/dsrm_password_reset.test.yml @@ -9,5 +9,5 @@ tests: - file_name: windows-security-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/dsrm_account/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog update_timestamp: true diff --git a/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml b/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml index a29b46ae0f..ea0c7e4b01 100644 --- a/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml +++ b/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml @@ -9,5 +9,5 @@ tests: - file_name: windows-security-xml.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog + sourcetype: xmlwineventlog update_timestamp: true From 20d5655cb30a1ba2d35f8fa2d66389590fc4f8f4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 30 Sep 2022 14:56:54 -0400 Subject: [PATCH 35/90] updating analytic story name --- detections/endpoint/active_directory_sid_history_abuse.yml | 2 +- detections/endpoint/dcshadow_attack.yml | 2 +- detections/endpoint/dcsync_attack.yml | 2 +- detections/endpoint/dsrm_account_changes.yml | 2 +- detections/endpoint/dsrm_password_reset.yml | 2 +- ...active_directory_sid_history_privileged_account_addition.yml | 2 +- detections/experimental/network/rogue_dc_network_activity.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/active_directory_sid_history_abuse.yml index 6a85348b5a..3ef1f8b74c 100644 --- a/detections/endpoint/active_directory_sid_history_abuse.yml +++ b/detections/endpoint/active_directory_sid_history_abuse.yml @@ -27,7 +27,7 @@ references: - https://adsecurity.org/?p=1772 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks - Windows Persistence Techniques asset_type: Endpoint cis20: diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/dcshadow_attack.yml index bdd98c8cc3..a39ca58913 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/dcshadow_attack.yml @@ -24,7 +24,7 @@ references: - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml index ed3fb19369..0982b115b0 100644 --- a/detections/endpoint/dcsync_attack.yml +++ b/detections/endpoint/dcsync_attack.yml @@ -34,7 +34,7 @@ references: - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks - Credential Dumping asset_type: Endpoint cis20: diff --git a/detections/endpoint/dsrm_account_changes.yml b/detections/endpoint/dsrm_account_changes.yml index 26664b08a8..62b6b2f19b 100644 --- a/detections/endpoint/dsrm_account_changes.yml +++ b/detections/endpoint/dsrm_account_changes.yml @@ -32,7 +32,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks - Windows Registry Abuse - Windows Persistence Techniques asset_type: Endpoint diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/dsrm_password_reset.yml index c0e568837c..7f862d0e81 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/dsrm_password_reset.yml @@ -22,7 +22,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks asset_type: Endpoint cis20: - CIS 6 diff --git a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml index beabde37fe..8633688b3f 100644 --- a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml @@ -29,7 +29,7 @@ references: - https://adsecurity.org/?p=1772 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/experimental/network/rogue_dc_network_activity.yml b/detections/experimental/network/rogue_dc_network_activity.yml index bc46c7e97d..9687b49ff4 100644 --- a/detections/experimental/network/rogue_dc_network_activity.yml +++ b/detections/experimental/network/rogue_dc_network_activity.yml @@ -17,7 +17,7 @@ references: - https://adsecurity.org/?p=1729 tags: analytic_story: - - Domain Controller Attacks + - Windows Domain Controller Attacks asset_type: Endpoint cis20: - CIS 4 From ad14a9f17b2c98353d08b2f801269be393dcacb8 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 30 Sep 2022 15:49:08 -0400 Subject: [PATCH 36/90] updating SID history detection --- ...ws_active_directory_sid_history_abuse.yml} | 20 ++++++++++--------- ...tive_directory_sid_history_abuse.test.yml} | 6 +++--- 2 files changed, 14 insertions(+), 12 deletions(-) rename detections/endpoint/{active_directory_sid_history_abuse.yml => windows_active_directory_sid_history_abuse.yml} (63%) rename tests/endpoint/{active_directory_sid_history_abuse.test.yml => windows_active_directory_sid_history_abuse.test.yml} (69%) diff --git a/detections/endpoint/active_directory_sid_history_abuse.yml b/detections/endpoint/windows_active_directory_sid_history_abuse.yml similarity index 63% rename from detections/endpoint/active_directory_sid_history_abuse.yml rename to detections/endpoint/windows_active_directory_sid_history_abuse.yml index 3ef1f8b74c..fab8e47aa6 100644 --- a/detections/endpoint/active_directory_sid_history_abuse.yml +++ b/detections/endpoint/windows_active_directory_sid_history_abuse.yml @@ -1,15 +1,15 @@ -name: Active Directory SID History Abuse +name: Windows Active Directory SID History Abuse id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d -version: 1 +version: 2 date: '2022-09-09' author: Dean Luxton type: TTP datamodel: [] -description: The SID history AD attribute allows users to inherit permissions from a separate AD account. Initially developed for access - continuity when migrating domains, the attribute can also be applied for two objects within the same domain. Enabling a stealthy way - for a user or computer object to be a member of a privileged group without any noisy group membership changes. This detection looks for - changes to user or computer objects with the addition of the SID History attribute - yes computer accounts too. - Working with SID Resolution enabled or disabled, written for XML-Wineventlog. +description: The following analytic looks for changes to user or computer objects where the SID History attribute has been modified. + The SID history AD attribute allows users to inherit permissions from a separate AD account by updating its AD attribute and setting it too the privileged users SID. Initially developed for access + continuity when migrating domains, this attribute can also be applied for two objects within the same domain. + Red teamers and adersaries alike who have obtained privileged access within an Active Directory domain may abuse this feature to escalate their privileges or establish a backdoor account + in a stealthy way and without noisy group memberhip changes. search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" @@ -17,14 +17,16 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user - | `active_directory_sid_history_abuse_filter`' + | `windows_active_directory_sid_history_abuse_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` - within `Account Management` need to be enabled. + within `Account Management` need to be enabled. SID resolution is not required. known_false_positives: Unknown references: - https://adsecurity.org/?p=1772 +- https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN +- https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute tags: analytic_story: - Windows Domain Controller Attacks diff --git a/tests/endpoint/active_directory_sid_history_abuse.test.yml b/tests/endpoint/windows_active_directory_sid_history_abuse.test.yml similarity index 69% rename from tests/endpoint/active_directory_sid_history_abuse.test.yml rename to tests/endpoint/windows_active_directory_sid_history_abuse.test.yml index 96351f997a..508c50d1d0 100644 --- a/tests/endpoint/active_directory_sid_history_abuse.test.yml +++ b/tests/endpoint/windows_active_directory_sid_history_abuse.test.yml @@ -1,7 +1,7 @@ -name: Active Directory SID History Abuse Unit Test +name: Windows Active Directory SID History Abuse Unit Test tests: -- name: Active Directory SID History Abuse - file: endpoint/active_directory_sid_history_abuse.yml +- name: Windows Active Directory SID History Abuse + file: endpoint/windows_active_directory_sid_history_abuse.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From a26ec4a671bb0f8ecde8bbd67ed4c63a40b64f14 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 30 Sep 2022 17:33:44 -0400 Subject: [PATCH 37/90] update dc shadow detection --- ...adow_attack.yml => windows_dcshadow_attack.yml} | 14 ++++++++++---- stories/windows_domain_controller_attacks.yml | 2 +- ...k.test.yml => windows_dcshadow_attack.test.yml} | 6 +++--- 3 files changed, 14 insertions(+), 8 deletions(-) rename detections/endpoint/{dcshadow_attack.yml => windows_dcshadow_attack.yml} (71%) rename tests/endpoint/{dcshadow_attack.test.yml => windows_dcshadow_attack.test.yml} (77%) diff --git a/detections/endpoint/dcshadow_attack.yml b/detections/endpoint/windows_dcshadow_attack.yml similarity index 71% rename from detections/endpoint/dcshadow_attack.yml rename to detections/endpoint/windows_dcshadow_attack.yml index a39ca58913..5f7e737bd3 100644 --- a/detections/endpoint/dcshadow_attack.yml +++ b/detections/endpoint/windows_dcshadow_attack.yml @@ -1,11 +1,14 @@ -name: DCShadow Attack +name: Windows DCShadow Attack id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 -version: 1 +version: 2 date: '2022-09-02' author: Dean Luxton type: TTP datamodel: [] -description: DCshadow is a Post Exploitation attack added to Mimikatz in 2018. The DCShadow attack requires domain admin privileges or equivalent. The attack works by temporarily assuming the role of a domain controller and pushing replication changes to the domain. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. +description: The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack. + DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject + and replicate changes int the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux. + No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*") | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType | stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature @@ -13,7 +16,7 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID src_ip as src] | table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") -| `dcshadow_attack_filter`' +| `windows_dcshadow_attack_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to @@ -21,7 +24,10 @@ how_to_implement: To successfully implement this search, you ned to be ingesting known_false_positives: None. references: - https://www.dcshadow.com/ +- https://blog.netwrix.com/2022/09/28/dcshadow_attack/ - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 +- https://attack.mitre.org/techniques/T1207/ +- https://blog.alsid.eu/dcshadow-explained-4510f52fc19d tags: analytic_story: - Windows Domain Controller Attacks diff --git a/stories/windows_domain_controller_attacks.yml b/stories/windows_domain_controller_attacks.yml index 9cf9e2a04b..3b1a2ff073 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/windows_domain_controller_attacks.yml @@ -4,7 +4,7 @@ version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. -narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an active directory network. +narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: diff --git a/tests/endpoint/dcshadow_attack.test.yml b/tests/endpoint/windows_dcshadow_attack.test.yml similarity index 77% rename from tests/endpoint/dcshadow_attack.test.yml rename to tests/endpoint/windows_dcshadow_attack.test.yml index 77cadc89aa..a463e80413 100644 --- a/tests/endpoint/dcshadow_attack.test.yml +++ b/tests/endpoint/windows_dcshadow_attack.test.yml @@ -1,7 +1,7 @@ -name: DCShadow Attack Unit Test +name: Windows DCShadow Attack Unit Test tests: -- name: DCShadow Attack - file: endpoint/dcshadow_attack.yml +- name: Windows DCShadow Attack + file: endpoint/windows_dcshadow_attack.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From eceb5f2b4a3323f4b3e132234a0797f695c1e6eb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 18 Oct 2022 10:59:45 -0400 Subject: [PATCH 38/90] adding new detection --- .../windows_short_lived_ad_server_object.yml | 53 +++++++++++++++++++ ...dows_short_lived_ad_server_object.test.yml | 13 +++++ 2 files changed, 66 insertions(+) create mode 100644 detections/endpoint/windows_short_lived_ad_server_object.yml create mode 100644 tests/endpoint/windows_short_lived_ad_server_object.test.yml diff --git a/detections/endpoint/windows_short_lived_ad_server_object.yml b/detections/endpoint/windows_short_lived_ad_server_object.yml new file mode 100644 index 0000000000..1374931f4c --- /dev/null +++ b/detections/endpoint/windows_short_lived_ad_server_object.yml @@ -0,0 +1,53 @@ +name: Windows Short Lived AD Server Object +id: 193769d3-1e33-43a9-970e-ad4a88256cdb +version: 1 +date: '2022-10-17' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' index=win EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers*" ObjectDN="*CN=Configuration*" + | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) + | eval short_lived=case((duration<30),"TRUE") + | search short_lived = TRUE + | stats values(ObjectDN) by _time, Computer, SubjectUserName + | `windows_short_lived_ad_server_object_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/short_lived_server_object/windows-security.log + impact: UPDATE value between 1-100 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1207 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: endpoint diff --git a/tests/endpoint/windows_short_lived_ad_server_object.test.yml b/tests/endpoint/windows_short_lived_ad_server_object.test.yml new file mode 100644 index 0000000000..911ddbddd3 --- /dev/null +++ b/tests/endpoint/windows_short_lived_ad_server_object.test.yml @@ -0,0 +1,13 @@ +name: Windows Short Lived AD Server Object Unit Test +tests: +- name: Windows Short Lived AD Server Object + file: endpoint/windows_short_lived_ad_server_object.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/short_lived_server_object/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true From 002a411ad0ba32152756b89b9af45502452d0d21 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 18 Oct 2022 15:19:51 -0400 Subject: [PATCH 39/90] updating dc shadow detection --- .../endpoint/windows_dcshadow_attack.yml | 2 +- .../windows_short_lived_ad_server_object.yml | 60 +++++++++++++------ 2 files changed, 43 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/windows_dcshadow_attack.yml b/detections/endpoint/windows_dcshadow_attack.yml index 5f7e737bd3..a03137de40 100644 --- a/detections/endpoint/windows_dcshadow_attack.yml +++ b/detections/endpoint/windows_dcshadow_attack.yml @@ -44,7 +44,7 @@ tags: impact: 100 kill_chain_phases: - Actions on Objectives - message: DCShadow Attack Detected from $src$ + message: Potential DCShadow Attack Detected from $src$ mitre_attack_id: - T1207 nist: diff --git a/detections/endpoint/windows_short_lived_ad_server_object.yml b/detections/endpoint/windows_short_lived_ad_server_object.yml index 1374931f4c..af2dd2b43d 100644 --- a/detections/endpoint/windows_short_lived_ad_server_object.yml +++ b/detections/endpoint/windows_short_lived_ad_server_object.yml @@ -5,49 +5,73 @@ date: '2022-10-17' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION -search: ' index=win EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers*" ObjectDN="*CN=Configuration*" - | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) +description: 'The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack. + DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject + and replicate changes in the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security + researchers Benjamin Delpy and Vincent Le Toux. Specifically, the detection will trigger when a possible rogue Domain Controller + computer object is created and quickly deleted within 30 seconds or less in an Active Directory domain. This behavior was identfied by simulating the DCShadow attack with + Mimikatz.' +search: ' `wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration*" + | transaction ObjectDN startswith=(EventCode=5137) endswith=(EventCode=5141) | eval short_lived=case((duration<30),"TRUE") | search short_lived = TRUE - | stats values(ObjectDN) by _time, Computer, SubjectUserName - | `windows_short_lived_ad_server_object_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES + | stats values(ObjectDN) values(signature) values(EventCode) by _time, Computer, SubjectUserName + | `windows_short_lived_ad_server_object_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting Event codes + `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required. +known_false_positives: Creating and deleting a server object within 30 seconds or less is unusual but not impossible in a production environment. Filter as needed. references: -- REFERENCE +- https://www.dcshadow.com/ +- https://attack.mitre.org/techniques/T1207/ +- https://stealthbits.com/blog/detecting-dcshadow-with-event-logs/ +- https://pentestlab.blog/2018/04/16/dcshadow/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137 +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141 tags: analytic_story: - Windows Domain Controller Attacks - asset_type: UPDATE asset_type + asset_type: Endpoint cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 80 context: - - Update context + - Source:Endpoint + - Stage:Defense Evasion + - Stage:Privilege Escalation + - Stage:Persistence dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/short_lived_server_object/windows-security.log - impact: UPDATE value between 1-100 + impact: 80 kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: Potential DCShadow Attack Detected on $Computer$ mitre_attack_id: - T1207 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: SubjectUserName + type: User role: - - UPDATE + - Attacker + - name: Computer + type: Hostname + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 + - _time + - EventCode + - ObjectDN + - signature + - SubjectUserName + - Computer + risk_score: 64 security_domain: endpoint From a77afedd0d9d3b179f7b064fd6e1a7fe9e13f87f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 15 Nov 2022 17:58:53 -0500 Subject: [PATCH 40/90] adding adminsdholder detection --- ...e_directory_adminsdholder_acl_modified.yml | 65 +++++++++++++++++++ ...ectory_adminsdholder_acl_modified.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/endpoint/active_directory_adminsdholder_acl_modified.yml create mode 100644 tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml diff --git a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml new file mode 100644 index 0000000000..7400527442 --- /dev/null +++ b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml @@ -0,0 +1,65 @@ +name: Active Directory AdminSDHolder ACL Modified +id: 00d877c3-7b7b-443d-9562-6b231e2abab9 +version: 1 +date: '2022-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: More to come +search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" + | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue + | `active_directory_adminsdholder_acl_modified_filter`' +how_to_implement: tbd +known_false_positives: tbd +references: +- https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory +- https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx +- https://adsecurity.org/?p=1906 +- https://pentestlab.blog/2022/01/04/domain-persistence-adminsdholder/ +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security.log + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1000 + nist: + - DE.CM + observable: + - name: SubjectUserName + type: User + role: + - Attacker + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - AttributeLDAPDisplayName + - OperationType + - ObjectDN + - Computer + - SubjectUserName + - AttributeValue + risk_score: 56 + security_domain: endpoint diff --git a/tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml b/tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml new file mode 100644 index 0000000000..742aadc2f5 --- /dev/null +++ b/tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml @@ -0,0 +1,13 @@ +name: Active Directory AdminSDHolder ACL Modified Unit Test +tests: +- name: Active Directory AdminSDHolder ACL Modified + file: endpoint/active_directory_adminsdholder_acl_modified.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/***/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true From 0ab958119a7b3c77cbe404757136ad3215e2f214 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 15 Nov 2022 18:00:35 -0500 Subject: [PATCH 41/90] updating mitre id --- .../endpoint/active_directory_adminsdholder_acl_modified.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml index 7400527442..872f48eacc 100644 --- a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml +++ b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml @@ -36,7 +36,7 @@ tags: - Actions on Objectives message: UPDATE message mitre_attack_id: - - T1000 + - T1546 nist: - DE.CM observable: From eebf59bc8b25c0e4162e68e9da53f59691cd2ad3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 16 Nov 2022 13:15:58 -0500 Subject: [PATCH 42/90] updating detection --- ...e_users_failing_to_authenticate_from_ip.yml | 1 + ...cp_multi_factor_authentication_disabled.yml | 1 + ...ve_directory_adminsdholder_acl_modified.yml | 18 ++++++++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml index 4dd30a3070..30c1179d88 100644 --- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml @@ -49,6 +49,7 @@ tags: - T1586.003 - T1110 - T1110.003 + - T1110.004 nist: - DE.CM observable: diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index e35f411f80..c6585220d1 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -42,6 +42,7 @@ tags: - T1586 - T1586.003 - T1556 + - T1556.006 nist: - DE.CM observable: diff --git a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml index 872f48eacc..37508d473b 100644 --- a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml +++ b/detections/endpoint/active_directory_adminsdholder_acl_modified.yml @@ -5,17 +5,27 @@ date: '2022-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: More to come +description: The following analytic identifies the modification of the Access Control List for the AdminSDHolder object within a Windows domain. Specifically, the + detection triggers on the addition of a new rule to the existing ACL. AdminSDHolder is an object located in the System Partition in Active Directory and is used as a + security template for objects that are members of certain privileged groups. Objects in these groups are enumerated and any objects with security descriptors that dont + match the AdminSDHolder ACL are flagged for updating. The Security Descriptor propagator (SDProp) process runs every 60 minutes on the PDC Emulator and re-stamps the object + Access Control List (ACL) with the security permissions set on the AdminSDHolder. An adversary who has obtained privileged access to a Windows Domain may modify the AdminSDHolder + ACL to establish persistence and allow an unprivileged user to take control of a domain. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue | `active_directory_adminsdholder_acl_modified_filter`' -how_to_implement: tbd -known_false_positives: tbd +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. +known_false_positives: Adding new users or groups to the AdminSDHolder ACL is not usual. Filter as needed references: - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-c--protected-accounts-and-groups-in-active-directory - https://social.technet.microsoft.com/wiki/contents/articles/22331.adminsdholder-protected-groups-and-security-descriptor-propagator.aspx - https://adsecurity.org/?p=1906 - https://pentestlab.blog/2022/01/04/domain-persistence-adminsdholder/ +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +- https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-lists +- https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950 tags: analytic_story: - Windows Domain Controller Attacks @@ -34,7 +44,7 @@ tags: kill_chain_phases: - Installation - Actions on Objectives - message: UPDATE message + message: The AdminSDHolder domain object has been modified on $Computer$ by $SubjectUserName$ mitre_attack_id: - T1546 nist: From 02c5a89aef9524ae247eaa5a73fdde7ac77fbfda Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 17 Nov 2022 17:48:02 +1000 Subject: [PATCH 43/90] Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates --- detections/endpoint/dcsync_attack.yml | 88 --------------- ...tion_request_initiated_by_user_account.yml | 84 +++++++++++++++ ...t_initiated_from_unsanctioned_location.yml | 101 ++++++++++++++++++ ...tory_same_domain_sid_history_addition.yml} | 19 ++-- ..._active_directory_sid_history_addition.yml | 75 +++++++++++++ ...s.yml => windows_dsrm_account_changes.yml} | 4 +- ...et.yml => windows_dsrm_password_reset.yml} | 4 +- ...ed_domain_controller_spn_ad_attribute.yml} | 29 ++--- ...ivileged_account_sid_history_addition.yml} | 11 +- ...equest_initiated_by_user_account.test.yml} | 0 ...tiated_from_unsanctioned_location.test.yml | 13 +++ ...same_domain_sid_history_addition.test.yml} | 0 ...ve_directory_sid_history_addition.test.yml | 13 +++ ... => windows_dsrm_account_changes.test.yml} | 0 ...l => windows_dsrm_password_reset.test.yml} | 0 ...main_controller_spn_ad_attribute.test.yml} | 0 ...ged_account_sid_history_addition.test.yml} | 0 17 files changed, 319 insertions(+), 122 deletions(-) delete mode 100644 detections/endpoint/dcsync_attack.yml create mode 100644 detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml create mode 100644 detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml rename detections/endpoint/{windows_active_directory_sid_history_abuse.yml => windows_active_directory_same_domain_sid_history_addition.yml} (70%) create mode 100644 detections/endpoint/windows_active_directory_sid_history_addition.yml rename detections/endpoint/{dsrm_account_changes.yml => windows_dsrm_account_changes.yml} (97%) rename detections/endpoint/{dsrm_password_reset.yml => windows_dsrm_password_reset.yml} (94%) rename detections/endpoint/{windows_dcshadow_attack.yml => windows_short_lived_domain_controller_spn_ad_attribute.yml} (54%) rename detections/experimental/endpoint/{active_directory_sid_history_privileged_account_addition.yml => windows_active_directory_privileged_account_sid_history_addition.yml} (82%) rename tests/endpoint/{dcsync_attack.test.yml => windows_active_directory_replication_request_initiated_by_user_account.test.yml} (100%) create mode 100644 tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml rename tests/endpoint/{windows_active_directory_sid_history_abuse.test.yml => windows_active_directory_same_domain_sid_history_addition.test.yml} (100%) create mode 100644 tests/endpoint/windows_active_directory_sid_history_addition.test.yml rename tests/endpoint/{dsrm_account_changes.test.yml => windows_dsrm_account_changes.test.yml} (100%) rename tests/endpoint/{dsrm_password_reset.test.yml => windows_dsrm_password_reset.test.yml} (100%) rename tests/endpoint/{windows_dcshadow_attack.test.yml => windows_short_lived_domain_controller_spn_ad_attribute.test.yml} (100%) rename tests/experimental/endpoint/{active_directory_sid_history_privileged_account_addition.test.yml => windows_active_directory_privileged_account_sid_history_addition.test.yml} (100%) diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml deleted file mode 100644 index 0982b115b0..0000000000 --- a/detections/endpoint/dcsync_attack.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: DCSync Attack -id: 51307514-1236-49f6-8686-d46d93cc2821 -version: 1 -date: '2022-09-08' -author: Dean Luxton -type: TTP -datamodel: [] -description: When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. - Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain. - This alert detects when a handle to domainDNS is opened with the necessary replication permissions. -search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", - "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", - "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") - | stats min(_time) as firstEvent, max(_time) as latestEvent, range(_time) as duration - count by AccessMask, SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, - ObjectServer, ObjectType, OperationType, status - | join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename - TargetLogonId as Logon_ID, TargetDomainName as domain] - | table firstEvent, latestEvent, duration, AccessMask, domain, user, Computer, Logon_ID, - ObjectName, ObjectServer, ObjectType, OperationType, status, src_ip, Logon_ID - | eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, - "%Y-%m-%d %H:%M:%S") | `dcsync_attack_filter`' -how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `4662`. - The Advanced Security Audit policy settings `Audit Directory Services Access` - within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root - and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` - auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and - `Replicating Directory Changes In Filtered Set` - If genuine DC activity triggers this detection within your environment, look to tune out the - domain controller computer accounts using asset and identities. -known_false_positives: A genuine domain controller promotion event will trigger this alert. -references: -- https://adsecurity.org/?p=1729 -- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer -tags: - analytic_story: - - Windows Domain Controller Attacks - - Credential Dumping - asset_type: Endpoint - cis20: - - CIS 4 - - CIS 6 - confidence: 80 - context: - - Source:Endpoint - - Source:AD - - Stage:Credential Access - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - impact: 100 - kill_chain_phases: - - Actions on Objectives - message: DCSync Attack Detected from $src$ - mitre_attack_id: - - T1003.006 - - T1003 - nist: - - DE.CM - observable: - - name: src_user - type: User - role: - - Victim - - name: src - type: IP Address - role: - - Attacker - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - required_fields: - - _time - - EventCode - - ObjectType - - Properties - - AccessMask - - SubjectDomainName - - SubjectUserName - - Computer - - Logon_ID - - ObjectName - - ObjectServer - - ObjectType - - OperationType - - status - risk_score: 80 - security_domain: endpoint diff --git a/detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml new file mode 100644 index 0000000000..836174d03a --- /dev/null +++ b/detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml @@ -0,0 +1,84 @@ +name: Windows Active Directory Replication Request Initiated by User Account +id: 51307514-1236-49f6-8686-d46d93cc2821 +version: 1 +date: '2022-09-08' +author: Dean Luxton +type: TTP +datamodel: [] +description: This alert was written to detect activity associated with the DCSync attack. + When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. + Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain. + This alert detects when a user account creates a handle to domainDNS with the necessary replication permissions. +search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") AND AccessMask="0x100" AND NOT (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") + | stats min(_time) as _time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status + | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as TargetLogonId, _time as attack_time + | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] + | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType + | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId + | `windows_active_directory_replication_request_initiated_by_user_account_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. + The Advanced Security Audit policy settings `Audit Directory Services Access` + within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root + and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` + auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and + `Replicating Directory Changes In Filtered Set` +known_false_positives: Azure AD Connect syncing operations. +references: +- https://adsecurity.org/?p=1729 +- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer +- https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml +tags: + analytic_story: + - Windows Domain Controller Attacks + - Credential Dumping + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + confidence: 100 + context: + - Source:Endpoint + - Source:AD + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Windows Active Directory Replication Request Initiated by User Account $user$ at $src_ip$ + mitre_attack_id: + - T1003.006 + - T1003 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectType + - Properties + - AccessMask + - SubjectDomainName + - SubjectUserName + - SubjectUserSid + - Computer + - Logon_ID + - ObjectName + - ObjectServer + - ObjectType + - OperationType + - status + risk_score: 100 + security_domain: endpoint diff --git a/detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml new file mode 100644 index 0000000000..f61e22c524 --- /dev/null +++ b/detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml @@ -0,0 +1,101 @@ +name: Windows Active Directory Replication Request Initiated from Unsanctioned Location +id: 50998483-bb15-457b-a870-965080d9e3d3 +version: 1 +date: '2022-11-17' +author: Dean Luxton +type: TTP +datamodel: [] +description: This alert was written to detect activity associated with the DCSync attack. + When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. + Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain. + This alert detects when any AD account creates a handle to domainDNS with the necessary replication permissions. These requests are then filtered to exclude where the events originate + from a known domain controller IP address. Note, this detection is viable for detecting DCSync attacks performed using computer accounts. +search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", + "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", + "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") + AND AccessMask="0x100" + + | stats min(_time) as attack_time, count by SubjectDomainName, SubjectUserName, + Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status + + | rename SubjectDomainName as Target_Domain, SubjectUserName as user, Logon_ID as + TargetLogonId + + | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] + + | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, + Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, + ObjectServer, ObjectType, OperationType + + | stats min(attack_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) + as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) + as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId + + | search NOT src_category="domain_controller" | `windows_active_directory_replication_request_initiated_from_unsanctioned_location_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. + The Advanced Security Audit policy settings `Audit Directory Services Access` + within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root + and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` + auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and + `Replicating Directory Changes In Filtered Set` + Assets and Identities will also need to be configured, with the category of domain_controller added for genuine DCs. +known_false_positives: Genuine DC promotion may trigger this alert. +references: +- https://adsecurity.org/?p=1729 +- https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer +- https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml +tags: + analytic_story: + - Windows Domain Controller Attacks + - Credential Dumping + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + confidence: 100 + context: + - Source:Endpoint + - Source:AD + - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Windows Active Directory Replication Request Initiated from Unsanctioned Location $src_ip$ by $user$ + mitre_attack_id: + - T1003.006 + - T1003 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectType + - Properties + - AccessMask + - SubjectDomainName + - SubjectUserName + - SubjectUserSid + - Computer + - Logon_ID + - ObjectName + - ObjectServer + - ObjectType + - OperationType + - status + risk_score: 100 + security_domain: endpoint diff --git a/detections/endpoint/windows_active_directory_sid_history_abuse.yml b/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml similarity index 70% rename from detections/endpoint/windows_active_directory_sid_history_abuse.yml rename to detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml index fab8e47aa6..de8b8decfb 100644 --- a/detections/endpoint/windows_active_directory_sid_history_abuse.yml +++ b/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml @@ -1,15 +1,14 @@ -name: Windows Active Directory SID History Abuse +name: Windows Active Directory Same Domain SID History Addition id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d version: 2 date: '2022-09-09' author: Dean Luxton type: TTP datamodel: [] -description: The following analytic looks for changes to user or computer objects where the SID History attribute has been modified. - The SID history AD attribute allows users to inherit permissions from a separate AD account by updating its AD attribute and setting it too the privileged users SID. Initially developed for access - continuity when migrating domains, this attribute can also be applied for two objects within the same domain. - Red teamers and adersaries alike who have obtained privileged access within an Active Directory domain may abuse this feature to escalate their privileges or establish a backdoor account - in a stealthy way and without noisy group memberhip changes. +description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects which exist within the same domain. + The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access + continuity when migrating user accounts to different domains, this attribute can also be abused to stealthily grant access to a backdoor account within the same domain. + This analytic was written to pick up on activity via Mimikatz sid::patch. Please note there are additional avenues to abuse SID history such as DCShadow & Golden / Diamond tickets which won't be detected using these event codes. search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" @@ -17,11 +16,11 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user - | `windows_active_directory_sid_history_abuse_filter`' + | `windows_active_directory_same_domain_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` - within `Account Management` need to be enabled. SID resolution is not required. + within `Account Management` all need to be enabled. SID resolution is not required. known_false_positives: Unknown references: - https://adsecurity.org/?p=1772 @@ -36,7 +35,7 @@ tags: - CIS 4 - CIS 6 - CIS 16 - confidence: 90 + confidence: 100 context: - Source:AD - Stage:Persistence @@ -74,5 +73,5 @@ tags: - user - src_user - Logon_ID - risk_score: 90 + risk_score: 100 security_domain: endpoint diff --git a/detections/endpoint/windows_active_directory_sid_history_addition.yml b/detections/endpoint/windows_active_directory_sid_history_addition.yml new file mode 100644 index 0000000000..9117651100 --- /dev/null +++ b/detections/endpoint/windows_active_directory_sid_history_addition.yml @@ -0,0 +1,75 @@ +name: Windows Active Directory SID History Addition +id: 41bbb371-28ba-439c-bb5c-d9930c28365d +version: 1 +date: '2022-11-17' +author: Dean Luxton +type: TTP +datamodel: [] +description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects. + The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access + continuity when migrating user accounts to different domains, this attribute can be abused for inter-domain privilege escalation and persistence. +search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793" + AND SidHistory!="-") + + | rename TargetSid as userSid + + | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_active_directory_sid_history_addition_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting eventcodes + `4738` and `4742`. The Advanced Security Audit policy settings + `Audit User Account Management` and `Audit Computer Account Management` + within `Account Management` all need to be enabled. +known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic. + Where this use case is not viable, please see the two auxillery use cases for same domain and privileged SID history additions. +references: +- https://adsecurity.org/?p=1772 +- https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN +- https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + - CIS 16 + confidence: 80 + context: + - Source:AD + - Stage:Persistence + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: Active Directory SID History Attribute was added to $user$ by $src_user$ + mitre_attack_id: + - T1134.005 + - T1134 + nist: + - DE.CM + observable: + - name: src_user + type: User + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - SidHistory + - TargetSid + - TargetDomainName + - user + - src_user + - Logon_ID + risk_score: 80 + security_domain: endpoint + diff --git a/detections/endpoint/dsrm_account_changes.yml b/detections/endpoint/windows_dsrm_account_changes.yml similarity index 97% rename from detections/endpoint/dsrm_account_changes.yml rename to detections/endpoint/windows_dsrm_account_changes.yml index 62b6b2f19b..886136624c 100644 --- a/detections/endpoint/dsrm_account_changes.yml +++ b/detections/endpoint/windows_dsrm_account_changes.yml @@ -1,4 +1,4 @@ -name: DSRM Account Changes +name: Windows DSRM Account Changes id: 08cb291e-ea77-48e8-a95a-0799319bf056 version: 1 date: '2022-09-08' @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time action dest user parent_process_name parent_process process_name process - process_guid registry_path registry_value_data registry_value_type | `dsrm_account_changes_filter`' + process_guid registry_path registry_value_data registry_value_type | `windows_dsrm_account_changes_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/dsrm_password_reset.yml b/detections/endpoint/windows_dsrm_password_reset.yml similarity index 94% rename from detections/endpoint/dsrm_password_reset.yml rename to detections/endpoint/windows_dsrm_password_reset.yml index 7f862d0e81..15478d7c7e 100644 --- a/detections/endpoint/dsrm_password_reset.yml +++ b/detections/endpoint/windows_dsrm_password_reset.yml @@ -1,4 +1,4 @@ -name: DSRM Password Reset +name: Windows DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 1 date: '2022-09-08' @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to set the Directory Services Restore Mode administrator password" by All_Changes.action, All_Changes.dest, All_Changes.src, All_Changes.user - | `drop_dm_object_name(All_Changes)` | `dsrm_password_reset_filter`' + | `drop_dm_object_name(All_Changes)` | `windows_dsrm_password_reset_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4794` and have the Advanced Security Audit policy `Audit User Account Management` within `Account Management` enabled. diff --git a/detections/endpoint/windows_dcshadow_attack.yml b/detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml similarity index 54% rename from detections/endpoint/windows_dcshadow_attack.yml rename to detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml index a03137de40..986905804b 100644 --- a/detections/endpoint/windows_dcshadow_attack.yml +++ b/detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml @@ -1,23 +1,24 @@ -name: Windows DCShadow Attack +name: Windows Short Lived Domain Controller SPN AD Attribute id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 version: 2 date: '2022-09-02' author: Dean Luxton type: TTP datamodel: [] -description: The following analytic identifies a change in an Active Directory environment that could represent evidence of the DCShadow attack. +description: The following analytic identifies when either a global catalog SPN or a DRS RPC SPN are temporarily added to an Active Directory computer object, both of which can be evidence of a DCShadow attack. DCShadow allows an attacker who has obtained privileged access to register a rogue Domain Controller (DC). Once registered, the rogue DC may be able to inject - and replicate changes int the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux. + and replicate changes into the AD infrastructure for any domain object, including credentials and keys. This technique was initially released in 2018 by security researchers Benjamin Delpy and Vincent Le Toux. No event logs are written for changes to AD attributes, allowing for stealthy backdoors to be implanted in the domain, or metadata such as timestamps overwritten to cover tracks. search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName (AttributeValue="GC/*" OR AttributeValue="E3514235-4B06-11D1-AB04-00C04FC2DCD2/*") -| replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType -| stats min(_time) as firstEvent max(_time) as latestEvent values(OperationType) as Action range(_time) as duration by src_nt_domain, src_user, Computer, ObjectDN, Logon_ID, signature -| where mvcount(Action) >1 -| join type=outer Logon_ID [| search `wineventlog_security` EventCode=4624 | rename TargetLogonId as Logon_ID src_ip as src] -| table firstEvent, latestEvent, duration, src_nt_domain, src_user, Computer, ObjectDN, Action, signature, src, Logon_ID -| eval firstEvent=strftime(firstEvent, "%Y-%m-%d %H:%M:%S"), latestEvent=strftime(latestEvent, "%Y-%m-%d %H:%M:%S") -| `windows_dcshadow_attack_filter`' -how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + | stats min(_time) as _time range(_time) as duration values(OperationType) as OperationType values(src_nt_domain) as src_nt_domain values(src_user) as src_user values(Computer) as Computer, values(ObjectDN) as ObjectDN by Logon_ID + | eval short_lived=case((duration<30),"TRUE") + | where short_lived="TRUE" AND mvcount(OperationType)>1 + | replace "%%14674" with "Value Added", "%%14675" with "Value Deleted" in OperationType + | rename Logon_ID as TargetLogonId + | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] + | stats min(_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip values(ObjectDN) as ObjectDN values(OperationType) as OperationType by TargetLogonId + | `windows_short_lived_domain_controller_spn_ad_attribute_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` applied to the domain root and all descendant objects. @@ -44,17 +45,17 @@ tags: impact: 100 kill_chain_phases: - Actions on Objectives - message: Potential DCShadow Attack Detected from $src$ + message: Short Lived Domain Controller SPN AD Attribute Triggered by $user$ from $src_ip$ mitre_attack_id: - T1207 nist: - DE.CM observable: - - name: src_user + - name: user type: User role: - Victim - - name: src + - name: src_ip type: IP Address role: - Attacker diff --git a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml similarity index 82% rename from detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml rename to detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml index 8633688b3f..a1e63ec3f2 100644 --- a/detections/experimental/endpoint/active_directory_sid_history_privileged_account_addition.yml +++ b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml @@ -1,4 +1,4 @@ -name: Active Directory SID History Privileged Account Addition +name: Windows Active Directory Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 version: 1 date: '2022-09-12' @@ -7,8 +7,8 @@ type: TTP datamodel: [] description: This detection identifies when the SID of a privileged user is added to the SID History attribute of another user. Useful for tracking SID history abuse - accross multiple domains. This detection leverages the Asset and Identities - framework. See the implemention section for further details on configuration. + across multiple domains. This detection leverages the Asset and Identities + framework. See the implementation section for further details on configuration. search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*?)(}$|$)" | eval category="privileged" @@ -16,11 +16,10 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | where isnotnull(match) | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user - | `active_directory_sid_history_privileged_account_addition_filter`' + | `windows_active_directory_privileged_account_sid_history_addition_filter`' how_to_implement: Ensure you have objectSid and the Down Level Logon Name `DOMAIN\sAMACountName` added to the identity field of your Asset and Identities lookup, along with the - category of privileged for the applicable users. If unsure, users with the AdminCount - attribute set with the value of 1 are great candidates. Also ensure you are + category of privileged for the applicable users. Ensure you are ingesting eventcodes 4742 and 4738. Two advanced audit policies `Audit User Account Management` and `Audit Computer Account Management` under `Account Management` are required to generate these event codes. diff --git a/tests/endpoint/dcsync_attack.test.yml b/tests/endpoint/windows_active_directory_replication_request_initiated_by_user_account.test.yml similarity index 100% rename from tests/endpoint/dcsync_attack.test.yml rename to tests/endpoint/windows_active_directory_replication_request_initiated_by_user_account.test.yml diff --git a/tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml b/tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml new file mode 100644 index 0000000000..d1cf5ba192 --- /dev/null +++ b/tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml @@ -0,0 +1,13 @@ +name: Windows Replication Event from Non-DC Computer Account Unit Test +tests: +- name: Windows Replication Event from Non-DC Computer Account + file: endpoint/windows_replication_event_from_non_dc_computer_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/endpoint/windows_active_directory_sid_history_abuse.test.yml b/tests/endpoint/windows_active_directory_same_domain_sid_history_addition.test.yml similarity index 100% rename from tests/endpoint/windows_active_directory_sid_history_abuse.test.yml rename to tests/endpoint/windows_active_directory_same_domain_sid_history_addition.test.yml diff --git a/tests/endpoint/windows_active_directory_sid_history_addition.test.yml b/tests/endpoint/windows_active_directory_sid_history_addition.test.yml new file mode 100644 index 0000000000..6b680dc9a4 --- /dev/null +++ b/tests/endpoint/windows_active_directory_sid_history_addition.test.yml @@ -0,0 +1,13 @@ +name: Windows Active Directory SID History Addition Unit Test +tests: +- name: Windows Active Directory SID History Addition + file: endpoint/windows_active_directory_sid_history_addition.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/endpoint/dsrm_account_changes.test.yml b/tests/endpoint/windows_dsrm_account_changes.test.yml similarity index 100% rename from tests/endpoint/dsrm_account_changes.test.yml rename to tests/endpoint/windows_dsrm_account_changes.test.yml diff --git a/tests/endpoint/dsrm_password_reset.test.yml b/tests/endpoint/windows_dsrm_password_reset.test.yml similarity index 100% rename from tests/endpoint/dsrm_password_reset.test.yml rename to tests/endpoint/windows_dsrm_password_reset.test.yml diff --git a/tests/endpoint/windows_dcshadow_attack.test.yml b/tests/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.test.yml similarity index 100% rename from tests/endpoint/windows_dcshadow_attack.test.yml rename to tests/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.test.yml diff --git a/tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml b/tests/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.test.yml similarity index 100% rename from tests/experimental/endpoint/active_directory_sid_history_privileged_account_addition.test.yml rename to tests/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.test.yml From fb249a1f250ba0ff974b23e2151f9b48edc03e8c Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 17 Nov 2022 17:56:28 +1000 Subject: [PATCH 44/90] Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates --- .../endpoint/windows_active_directory_sid_history_addition.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_active_directory_sid_history_addition.yml b/detections/endpoint/windows_active_directory_sid_history_addition.yml index 9117651100..30faeeca66 100644 --- a/detections/endpoint/windows_active_directory_sid_history_addition.yml +++ b/detections/endpoint/windows_active_directory_sid_history_addition.yml @@ -27,7 +27,7 @@ references: tags: analytic_story: - Windows Domain Controller Attacks - asset_type: Endpoint + asset_type: Endpoint cis20: - CIS 4 - CIS 6 From 85e1677fc567f0a13e57598b20683557b14dde93 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 17 Nov 2022 18:02:58 +1000 Subject: [PATCH 45/90] Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates --- ...lication_request_initiated_from_unsanctioned_location.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml => windows_ad_replication_request_initiated_from_unsanctioned_location.yml} (94%) diff --git a/detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml similarity index 94% rename from detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml rename to detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index f61e22c524..ee9c07fc9e 100644 --- a/detections/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -1,4 +1,4 @@ -name: Windows Active Directory Replication Request Initiated from Unsanctioned Location +name: Windows AD Replication Request Initiated from Unsanctioned Location id: 50998483-bb15-457b-a870-965080d9e3d3 version: 1 date: '2022-11-17' @@ -31,7 +31,7 @@ search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-1 as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId - | search NOT src_category="domain_controller" | `windows_active_directory_replication_request_initiated_from_unsanctioned_location_filter`' + | search NOT src_category="domain_controller" | `windows_ad_replication_request_initiated_from_unsanctioned_location_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root From 35edd394fc1ebd3740255d374ad6685691893038 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 17 Nov 2022 18:07:04 +1000 Subject: [PATCH 46/90] Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates --- ...ication_request_initiated_from_unsanctioned_location.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml => windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml} (100%) diff --git a/tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml similarity index 100% rename from tests/endpoint/windows_active_directory_replication_request_initiated_from_unsanctioned_location.test.yml rename to tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml From a103867d817f70e5086bd79adddb512ae75b9e5f Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 17 Nov 2022 18:14:00 +1000 Subject: [PATCH 47/90] Updating DCSync and Dcshadow Detections, adding another SID History detection, renames and updates --- ...dows_ad_replication_request_initiated_by_user_account.yml} | 4 ++-- ...ad_replication_request_initiated_by_user_account.test.yml} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_active_directory_replication_request_initiated_by_user_account.yml => windows_ad_replication_request_initiated_by_user_account.yml} (96%) rename tests/endpoint/{windows_active_directory_replication_request_initiated_by_user_account.test.yml => windows_ad_replication_request_initiated_by_user_account.test.yml} (100%) diff --git a/detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml similarity index 96% rename from detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml rename to detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 836174d03a..597b637a2d 100644 --- a/detections/endpoint/windows_active_directory_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -1,4 +1,4 @@ -name: Windows Active Directory Replication Request Initiated by User Account +name: Windows AD Replication Request Initiated by User Account id: 51307514-1236-49f6-8686-d46d93cc2821 version: 1 date: '2022-09-08' @@ -15,7 +15,7 @@ search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-1 | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | table attack_time, AuthenticationPackageName, LogonProcessName, LogonType, TargetUserSid, Target_Domain, user, Computer, TargetLogonId, status, src_ip, src_category, ObjectName, ObjectServer, ObjectType, OperationType | stats min(attack_time) as _time values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip by TargetLogonId - | `windows_active_directory_replication_request_initiated_by_user_account_filter`' + | `windows_ad_replication_request_initiated_by_user_account_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4662`. The Advanced Security Audit policy settings `Audit Directory Services Access` within `DS Access` needs to be enabled, as well as the following SACLs applied to the domain root diff --git a/tests/endpoint/windows_active_directory_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml similarity index 100% rename from tests/endpoint/windows_active_directory_replication_request_initiated_by_user_account.test.yml rename to tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml From 56b8b99b282964c8e8c18cf19afa45980e387568 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 13:47:43 -0500 Subject: [PATCH 48/90] adding new sid history detection --- ...rectory_sid_history_attribute_modified.yml | 66 +++++++++++++++++++ ...ctory_same_domain_sid_history_addition.yml | 3 +- ..._active_directory_sid_history_addition.yml | 7 +- ...ry_sid_history_attribute_modified.test.yml | 13 ++++ 4 files changed, 83 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/active_directory_sid_history_attribute_modified.yml create mode 100644 tests/endpoint/active_directory_sid_history_attribute_modified.test.yml diff --git a/detections/endpoint/active_directory_sid_history_attribute_modified.yml b/detections/endpoint/active_directory_sid_history_attribute_modified.yml new file mode 100644 index 0000000000..fdf3274525 --- /dev/null +++ b/detections/endpoint/active_directory_sid_history_attribute_modified.yml @@ -0,0 +1,66 @@ +name: Active Directory SID History Attribute Modified +id: 1155e47d-307f-4247-beab-71071e3a458c +version: 1 +date: '2022-11-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic leverages event code `5136` to identify a modification of the SID History AD attribute. + The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access + continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries to stealthily grant access to a backdoor account within the same domain. +search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory OperationType="%%14674" + | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue + | `active_directory_sid_history_attribute_modified_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications. +known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic. +references: +- https://adsecurity.org/?p=1772 +- https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN +- https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute +- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: SID History AD attribute modified by $SubjectUserName$ for $ObjectDN$ + mitre_attack_id: + - T1134 + - T1134.005 + nist: + - DE.CM + observable: + - name: SubjectUserName + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - AttributeLDAPDisplayName + - OperationType= + - ObjectDN + - Computer + - SubjectUserName + - AttributeValue + risk_score: 56 + security_domain: endpoint diff --git a/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml b/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml index de8b8decfb..bdc8ce3378 100644 --- a/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml @@ -7,7 +7,7 @@ type: TTP datamodel: [] description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects which exist within the same domain. The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access - continuity when migrating user accounts to different domains, this attribute can also be abused to stealthily grant access to a backdoor account within the same domain. + continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries to stealthily grant access to a backdoor account within the same domain. This analytic was written to pick up on activity via Mimikatz sid::patch. Please note there are additional avenues to abuse SID history such as DCShadow & Golden / Diamond tickets which won't be detected using these event codes. search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) @@ -26,6 +26,7 @@ references: - https://adsecurity.org/?p=1772 - https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute +- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection tags: analytic_story: - Windows Domain Controller Attacks diff --git a/detections/endpoint/windows_active_directory_sid_history_addition.yml b/detections/endpoint/windows_active_directory_sid_history_addition.yml index 30faeeca66..f044bb40ea 100644 --- a/detections/endpoint/windows_active_directory_sid_history_addition.yml +++ b/detections/endpoint/windows_active_directory_sid_history_addition.yml @@ -7,12 +7,9 @@ type: TTP datamodel: [] description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects. The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access - continuity when migrating user accounts to different domains, this attribute can be abused for inter-domain privilege escalation and persistence. -search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793" - AND SidHistory!="-") - + continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries for inter-domain privilege escalation and persistence. +search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793" AND SidHistory!="-") | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_active_directory_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings diff --git a/tests/endpoint/active_directory_sid_history_attribute_modified.test.yml b/tests/endpoint/active_directory_sid_history_attribute_modified.test.yml new file mode 100644 index 0000000000..422393853a --- /dev/null +++ b/tests/endpoint/active_directory_sid_history_attribute_modified.test.yml @@ -0,0 +1,13 @@ +name: Active Directory SID History Attribute Modified Unit Test +tests: +- name: Active Directory SID History Attribute Modified + file: endpoint/active_directory_sid_history_attribute_modified.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true From 957a4644de987a019c8aa16d98ab8ee60322ad07 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 14:15:54 -0500 Subject: [PATCH 49/90] Delete test_config_github_actions.json.bak --- .../test_config_github_actions.json.bak | 124 ------------------ 1 file changed, 124 deletions(-) delete mode 100644 bin/docker_detection_tester/test_config_github_actions.json.bak diff --git a/bin/docker_detection_tester/test_config_github_actions.json.bak b/bin/docker_detection_tester/test_config_github_actions.json.bak deleted file mode 100644 index 0872c356ea..0000000000 --- a/bin/docker_detection_tester/test_config_github_actions.json.bak +++ /dev/null @@ -1,124 +0,0 @@ -{ - "apps": { - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PALO_ALTO_NETWORKS_ADD_ON_FOR_SPLUNK": { - "app_number": 2757, - "app_version": "7.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/palo-alto-networks-add-on-for-splunk_710.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "4.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_400.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_850.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_810.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_810.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "3.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_300.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.6.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_860.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_501.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - "URL_TOOLBOX": { - "app_number": 2734, - "app_version": "1.9.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" - }, - "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { - "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" - } - }, - "branch": "BRANCH_DOES_NOT_EXIST_USE_CLI_ARGUMENT", - "commit_hash": null, - "container_tag": "latest", - "detections_list": null, - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": false, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "changes", - "no_interactive_failure": true, - "num_containers": 10, - "persist_security_content": false, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} From 4b15c5705c55675093cfffc5b2a48e02b814996a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 15:24:32 -0500 Subject: [PATCH 50/90] renaming detections --- ...dified.yml => windows_ad_adminsdholder_acl_modified.yml} | 4 ++-- ...ject.yml => windows_ad_short_lived_ad_server_object.yml} | 4 ++-- ...ed.yml => windows_ad_sid_history_attribute_modified.yml} | 4 ++-- ...t.yml => windows_ad_adminsdholder_acl_modified.test.yml} | 6 +++--- ...st.yml => windows_ad_short_lived_server_object.test.yml} | 4 ++-- ...l => windows_ad_sid_history_attribute_modified.test.yml} | 6 +++--- 6 files changed, 14 insertions(+), 14 deletions(-) rename detections/endpoint/{active_directory_adminsdholder_acl_modified.yml => windows_ad_adminsdholder_acl_modified.yml} (96%) rename detections/endpoint/{windows_short_lived_ad_server_object.yml => windows_ad_short_lived_ad_server_object.yml} (97%) rename detections/endpoint/{active_directory_sid_history_attribute_modified.yml => windows_ad_sid_history_attribute_modified.yml} (95%) rename tests/endpoint/{active_directory_adminsdholder_acl_modified.test.yml => windows_ad_adminsdholder_acl_modified.test.yml} (67%) rename tests/endpoint/{windows_short_lived_ad_server_object.test.yml => windows_ad_short_lived_server_object.test.yml} (79%) rename tests/endpoint/{active_directory_sid_history_attribute_modified.test.yml => windows_ad_sid_history_attribute_modified.test.yml} (67%) diff --git a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml similarity index 96% rename from detections/endpoint/active_directory_adminsdholder_acl_modified.yml rename to detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 37508d473b..f48e526114 100644 --- a/detections/endpoint/active_directory_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,4 +1,4 @@ -name: Active Directory AdminSDHolder ACL Modified +name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 version: 1 date: '2022-11-15' @@ -13,7 +13,7 @@ description: The following analytic identifies the modification of the Access Co ACL to establish persistence and allow an unprivileged user to take control of a domain. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue - | `active_directory_adminsdholder_acl_modified_filter`' + | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for the AdminSDHolder object in order to log modifications. diff --git a/detections/endpoint/windows_short_lived_ad_server_object.yml b/detections/endpoint/windows_ad_short_lived_ad_server_object.yml similarity index 97% rename from detections/endpoint/windows_short_lived_ad_server_object.yml rename to detections/endpoint/windows_ad_short_lived_ad_server_object.yml index af2dd2b43d..72e98b1d0a 100644 --- a/detections/endpoint/windows_short_lived_ad_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_ad_server_object.yml @@ -1,4 +1,4 @@ -name: Windows Short Lived AD Server Object +name: Windows AD Short Lived Server Object id: 193769d3-1e33-43a9-970e-ad4a88256cdb version: 1 date: '2022-10-17' @@ -16,7 +16,7 @@ search: ' `wineventlog_security` EventCode=5137 OR EventCode=5141 ObjectDN="*CN= | eval short_lived=case((duration<30),"TRUE") | search short_lived = TRUE | stats values(ObjectDN) values(signature) values(EventCode) by _time, Computer, SubjectUserName - | `windows_short_lived_ad_server_object_filter`' + | `windows_ad_short_lived_server_object_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting Event codes `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required. diff --git a/detections/endpoint/active_directory_sid_history_attribute_modified.yml b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml similarity index 95% rename from detections/endpoint/active_directory_sid_history_attribute_modified.yml rename to detections/endpoint/windows_ad_sid_history_attribute_modified.yml index fdf3274525..3b828b08e8 100644 --- a/detections/endpoint/active_directory_sid_history_attribute_modified.yml +++ b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml @@ -1,4 +1,4 @@ -name: Active Directory SID History Attribute Modified +name: Windows AD SID History Attribute Modified id: 1155e47d-307f-4247-beab-71071e3a458c version: 1 date: '2022-11-16' @@ -10,7 +10,7 @@ description: The following analytic leverages event code `5136` to identify a mo continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries to stealthily grant access to a backdoor account within the same domain. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=sIDHistory OperationType="%%14674" | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue - | `active_directory_sid_history_attribute_modified_filter`' + | `windows_ad_sid_history_attribute_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications. diff --git a/tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml b/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml similarity index 67% rename from tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml rename to tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml index 742aadc2f5..9ee2658f22 100644 --- a/tests/endpoint/active_directory_adminsdholder_acl_modified.test.yml +++ b/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml @@ -1,7 +1,7 @@ -name: Active Directory AdminSDHolder ACL Modified Unit Test +name: Windows AD AdminSDHolder ACL Modified Unit Test tests: -- name: Active Directory AdminSDHolder ACL Modified - file: endpoint/active_directory_adminsdholder_acl_modified.yml +- name: Windows AD AdminSDHolder ACL Modified + file: endpoint/windows_ad_adminsdholder_acl_modified.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_short_lived_ad_server_object.test.yml b/tests/endpoint/windows_ad_short_lived_server_object.test.yml similarity index 79% rename from tests/endpoint/windows_short_lived_ad_server_object.test.yml rename to tests/endpoint/windows_ad_short_lived_server_object.test.yml index 911ddbddd3..0593d3ac4c 100644 --- a/tests/endpoint/windows_short_lived_ad_server_object.test.yml +++ b/tests/endpoint/windows_ad_short_lived_server_object.test.yml @@ -1,7 +1,7 @@ -name: Windows Short Lived AD Server Object Unit Test +name: Windows AD Short Lived Server Object Unit Test tests: - name: Windows Short Lived AD Server Object - file: endpoint/windows_short_lived_ad_server_object.yml + file: endpoint/windows_ad_short_lived_server_object.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/active_directory_sid_history_attribute_modified.test.yml b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml similarity index 67% rename from tests/endpoint/active_directory_sid_history_attribute_modified.test.yml rename to tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml index 422393853a..2809d85fdb 100644 --- a/tests/endpoint/active_directory_sid_history_attribute_modified.test.yml +++ b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml @@ -1,7 +1,7 @@ -name: Active Directory SID History Attribute Modified Unit Test +name: Windows AD SID History Attribute Modified tests: -- name: Active Directory SID History Attribute Modified - file: endpoint/active_directory_sid_history_attribute_modified.yml +- name: Windows AD SID History Attribute Modified + file: endpoint/windows_ad_sid_history_attribute_modified.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 302583bf627cfcc4f675cc32c50e8302df835ee3 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 15:27:25 -0500 Subject: [PATCH 51/90] adding proper dataset url --- tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml b/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml index 9ee2658f22..8648fa463e 100644 --- a/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml +++ b/tests/endpoint/windows_ad_adminsdholder_acl_modified.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/***/windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546/adminsdholder_modified/windows-security.log source: XmlWinEventLog sourcetype: XmlWinEventLog update_timestamp: true From 6875fad0537d8174f0a0d8a5a8414cce9c52223c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 17:18:54 -0500 Subject: [PATCH 52/90] adding new detection --- ...eprincipalname_added_to_domain_account.yml | 65 +++++++++++++++++++ ...cipalname_added_to_domain_account.test.yml | 13 ++++ 2 files changed, 78 insertions(+) create mode 100644 detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml create mode 100644 tests/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.test.yml diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml new file mode 100644 index 0000000000..0ddc580b98 --- /dev/null +++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml @@ -0,0 +1,65 @@ +name: Windows AD ServicePrincipalName Added To Domain Account +id: 8a1259cb-0ea7-409c-8bfe-74bad89259f9 +version: 1 +date: '2022-11-17' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: tbd +search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName OperationType="%%14674" + | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue + | `windows_ad_serviceprincipalname_added_to_domain_account_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting Event codes + `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required. +known_false_positives: A Service Principal Name should only be added to an account when an application requires it. While infrequent, this detection may trigger on + legitimate actions. Filter as needed. +references: +- https://adsecurity.org/?p=3466 +- https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +tags: + analytic_story: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/service_principal_name_added/windows-security.log + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - UPDATE_DATASET_URL + impact: 60 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A Servince Principal Name for $ObjectDN$ was set by $SubjectUserName$ + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: SubjectUserName + type: User + role: + - Attacker + - name: ObjectDN + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectDN + - signature + - SubjectUserName + - Computer + risk_score: 30 + security_domain: endpoint diff --git a/tests/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.test.yml b/tests/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.test.yml new file mode 100644 index 0000000000..71d06d0868 --- /dev/null +++ b/tests/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.test.yml @@ -0,0 +1,13 @@ +name: Windows AD ServicePrincipalName Added To Domain Account Unit Test +tests: +- name: Windows AD ServicePrincipalName Added To Domain Account + file: endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/service_principal_name_added/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true From 651426899d5078efce93aa77eb8a1e002af3570f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 17 Nov 2022 18:35:11 -0500 Subject: [PATCH 53/90] improving detection --- detections/endpoint/windows_ad_adminsdholder_acl_modified.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index f48e526114..ace270bb4e 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -12,7 +12,8 @@ description: The following analytic identifies the modification of the Access Co Access Control List (ACL) with the security permissions set on the AdminSDHolder. An adversary who has obtained privileged access to a Windows Domain may modify the AdminSDHolder ACL to establish persistence and allow an unprivileged user to take control of a domain. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor OperationType="%%14674" ObjectDN="CN=AdminSDHolder,CN=System*" - | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue + | rex field=AttributeValue max_match=10000 "A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;(?PS-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3})\)" + | stats values(added_user_sid) by _time, Computer, SubjectUserName, ObjectDN | `windows_ad_adminsdholder_acl_modified_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` From d3a1ad7283c3b60afe66364c92a584fa7d484e10 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:39:03 +1000 Subject: [PATCH 54/90] Adding Domain Repl ACL detection & detection renaming --- ..._ad_cross_domain_sid_history_addition.yml} | 18 ++-- ...ows_ad_domain_replication_acl_addition.yml | 89 +++++++++++++++++++ ...ml => windows_ad_dsrm_account_changes.yml} | 4 +- ...yml => windows_ad_dsrm_password_reset.yml} | 4 +- ...lived_domain_controller_spn_attribute.yml} | 4 +- ...s_ad_same_domain_sid_history_addition.yml} | 4 +- ...ross_domain_sid_history_addition.test.yml} | 6 +- ...d_domain_replication_acl_addition.test.yml | 13 +++ ... windows_ad_dsrm_account_changes.test.yml} | 6 +- ...> windows_ad_dsrm_password_reset.test.yml} | 6 +- ..._domain_controller_spn_attribute.test.yml} | 6 +- ...same_domain_sid_history_addition.test.yml} | 6 +- 12 files changed, 134 insertions(+), 32 deletions(-) rename detections/endpoint/{windows_active_directory_sid_history_addition.yml => windows_ad_cross_domain_sid_history_addition.yml} (80%) create mode 100644 detections/endpoint/windows_ad_domain_replication_acl_addition.yml rename detections/endpoint/{windows_dsrm_account_changes.yml => windows_ad_dsrm_account_changes.yml} (97%) rename detections/endpoint/{windows_dsrm_password_reset.yml => windows_ad_dsrm_password_reset.yml} (94%) rename detections/endpoint/{windows_short_lived_domain_controller_spn_ad_attribute.yml => windows_ad_lived_domain_controller_spn_attribute.yml} (96%) rename detections/endpoint/{windows_active_directory_same_domain_sid_history_addition.yml => windows_ad_same_domain_sid_history_addition.yml} (95%) rename tests/endpoint/{windows_active_directory_sid_history_addition.test.yml => windows_ad_cross_domain_sid_history_addition.test.yml} (54%) create mode 100644 tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml rename tests/endpoint/{windows_dsrm_account_changes.test.yml => windows_ad_dsrm_account_changes.test.yml} (74%) rename tests/endpoint/{windows_dsrm_password_reset.test.yml => windows_ad_dsrm_password_reset.test.yml} (74%) rename tests/endpoint/{windows_short_lived_domain_controller_spn_ad_attribute.test.yml => windows_ad_lived_domain_controller_spn_attribute.test.yml} (65%) rename tests/endpoint/{windows_active_directory_same_domain_sid_history_addition.test.yml => windows_ad_same_domain_sid_history_addition.test.yml} (69%) diff --git a/detections/endpoint/windows_active_directory_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml similarity index 80% rename from detections/endpoint/windows_active_directory_sid_history_addition.yml rename to detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 30faeeca66..7ef80ee5fa 100644 --- a/detections/endpoint/windows_active_directory_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -1,25 +1,25 @@ -name: Windows Active Directory SID History Addition +name: Windows AD Cross Domain SID History Addition id: 41bbb371-28ba-439c-bb5c-d9930c28365d version: 1 date: '2022-11-17' author: Dean Luxton type: TTP datamodel: [] -description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects. +description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects within different domains. The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access continuity when migrating user accounts to different domains, this attribute can be abused for inter-domain privilege escalation and persistence. -search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793" - AND SidHistory!="-") - - | rename TargetSid as userSid - - | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_active_directory_sid_history_addition_filter`' +search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) + | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" + | rex field=TargetSid "^(?P.*)(\-|\\\)" + | where SidHistoryMatch!=TargetSidmatch AND SidHistoryMatch!=TargetDomainName + | rename TargetSid as userSid + | table _time action status host user userSid SidHistory Logon_ID src_user + | `windows_ad_cross_domain_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` within `Account Management` all need to be enabled. known_false_positives: Domain mergers and migrations may generate large volumes of false positives for this analytic. - Where this use case is not viable, please see the two auxillery use cases for same domain and privileged SID history additions. references: - https://adsecurity.org/?p=1772 - https://learn.microsoft.com/en-us/windows/win32/adschema/a-sidhistory?redirectedfrom=MSDN diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml new file mode 100644 index 0000000000..6a7e961cc4 --- /dev/null +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -0,0 +1,89 @@ +name: Windows AD Domain Replication ACL Addition +id: 8c372853-f459-4995-afdc-280c114d33ab +version: 1 +date: '2022-11-18' +author: Dean Luxton +type: TTP +datamodel: [] +description: This analytic detects the addition of the permissions necessary to perform a DCSync attack. + In order to replicate AD objects, the initiating user or computer must have the following permissions on the domain. + - DS-Replication-Get-Changes + - DS-Replication-Get-Changes-All + Certain Sync operations may require the additional permission of DS-Replication-Get-Changes-In-Filtered-Set. + By default, adding DCSync permissions via the Powerview Add-ObjectACL operation adds all 3. This alert identifies where this trifecta has been met, and also where just the base level requirements have been met. +search: "`wineventlog_security` (EventCode=5136) AttributeLDAPDisplayName=\"ntSecurityDescriptor\"\ + \ \"1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\" OR \"1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\"\ + \ OR \"89e95b76-444d-4c62-991a-0facbeda640c\" \n| where AttributeValue like \"%1131f6ad-9c07-11d1-f79f-00c04fc2dcd2%\"\ + \ AND AttributeValue like \"%1131f6aa-9c07-11d1-f79f-00c04fc2dcd2%\" AND AttributeValue\ + \ like \"%89e95b76-444d-4c62-991a-0facbeda640c%\" \n| search NOT ObjectClass IN\ + \ (dnsNode,dnsZoneScope,dnsZone)\n| rex field=AttributeValue max_match=10000 \"\ + OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;(?PS-1-[0-59]-\\\ + d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{3})\\)\"\n| rex field=AttributeValue\ + \ max_match=10000 \"OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;(?PS-1-[0-59]-\\\ + d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{3})\\)\"\n| rex field=AttributeValue\ + \ max_match=10000 \"OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;(?PS-1-[0-59]-\\\ + d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{3})\\)\"\n| table _time dest src_user DSRGetChanges_user_sid\ + \ DSRGetChangesAll_user_sid DSRGetChangesFiltered_user_sid\n| mvexpand DSRGetChanges_user_sid\n\ + | eval minDCSyncPermissions=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid,\"\ + true\",\"false\"), fullSet=if(DSRGetChanges_user_sid=DSRGetChangesAll_user_sid AND\ + \ DSRGetChanges_user_sid=DSRGetChangesFiltered_user_sid,\"true\",\"false\")\n| where\ + \ minDCSyncPermissions=\"true\"\n| lookup identity_lookup_expanded objectSid as\ + \ DSRGetChanges_user_sid OUTPUT sAMAccountName as user\n| rename DSRGetChanges_user_sid\ + \ as userSid\n| stats min(_time) as _time values(user) as user by dest src_user userSid minDCSyncPermissions fullSet|\ + \ `windows_ad_domain_replication_acl_addition_filter`" +how_to_implement: To successfully implement this search, you need to be ingesting the eventcode 5136. The Advanced Security Audit policy setting + `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to `Write All Properties` + applied to the domain root and all descendant objects. Once the necessary logging has been enabled, enumerate the domain policy to verify if existing + accounts with access need to be whitelisted, or revoked. Assets and Identities is also leveraged to automatically translate the objectSid into username. + Ensure your identities lookup is configured with the sAMAccountName and objectSid of all AD user and computer objects. +known_false_positives: When there is a change to nTSecurityDescriptor, Windows logs the entire ACL with the newly added components. + If existing accounts are present with this permission, they will raise an alert each time the nTSecurityDescriptor is updated unless whitelisted. +references: +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/1522b774-6464-41a3-87a5-1e5633c3fbbb +- https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 6 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: $src_user$ has granted $user$ permission to replicate AD objects + mitre_attack_id: + - T1484 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: src_user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - src_user + - AttributeLDAPDisplayName + - AttributeValue + - ObjectClass + risk_score: 80 + security_domain: endpoint diff --git a/detections/endpoint/windows_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml similarity index 97% rename from detections/endpoint/windows_dsrm_account_changes.yml rename to detections/endpoint/windows_ad_dsrm_account_changes.yml index 886136624c..629776bbfc 100644 --- a/detections/endpoint/windows_dsrm_account_changes.yml +++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml @@ -1,4 +1,4 @@ -name: Windows DSRM Account Changes +name: Windows AD DSRM Account Changes id: 08cb291e-ea77-48e8-a95a-0799319bf056 version: 1 date: '2022-09-08' @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time action dest user parent_process_name parent_process process_name process - process_guid registry_path registry_value_data registry_value_type | `windows_dsrm_account_changes_filter`' + process_guid registry_path registry_value_data registry_value_type | `windows_ad_dsrm_account_changes_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response diff --git a/detections/endpoint/windows_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml similarity index 94% rename from detections/endpoint/windows_dsrm_password_reset.yml rename to detections/endpoint/windows_ad_dsrm_password_reset.yml index 15478d7c7e..6dd8b5ade5 100644 --- a/detections/endpoint/windows_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -1,4 +1,4 @@ -name: Windows DSRM Password Reset +name: Windows AD DSRM Password Reset id: d1ab841c-36a6-46cf-b50f-b2b04b31182a version: 1 date: '2022-09-08' @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as _time from data where All_Changes.result_id="4794" AND All_Changes.result="An attempt was made to set the Directory Services Restore Mode administrator password" by All_Changes.action, All_Changes.dest, All_Changes.src, All_Changes.user - | `drop_dm_object_name(All_Changes)` | `windows_dsrm_password_reset_filter`' + | `drop_dm_object_name(All_Changes)` | `windows_ad_dsrm_password_reset_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `4794` and have the Advanced Security Audit policy `Audit User Account Management` within `Account Management` enabled. diff --git a/detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml b/detections/endpoint/windows_ad_lived_domain_controller_spn_attribute.yml similarity index 96% rename from detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml rename to detections/endpoint/windows_ad_lived_domain_controller_spn_attribute.yml index 986905804b..373f6a70ee 100644 --- a/detections/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.yml +++ b/detections/endpoint/windows_ad_lived_domain_controller_spn_attribute.yml @@ -1,4 +1,4 @@ -name: Windows Short Lived Domain Controller SPN AD Attribute +name: Windows AD Short Lived Domain Controller SPN Attribute id: 57e27f27-369c-4df8-af08-e8c7ee8373d4 version: 2 date: '2022-09-02' @@ -17,7 +17,7 @@ search: '`wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=serviceP | rename Logon_ID as TargetLogonId | appendpipe [| map search="search `wineventlog_security` EventCode=4624 TargetLogonId=$TargetLogonId$"] | stats min(_time) as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain, values(user) as user, values(Computer) as Computer, values(status) as status, values(src_category) as src_category, values(src_ip) as src_ip values(ObjectDN) as ObjectDN values(OperationType) as OperationType by TargetLogonId - | `windows_short_lived_domain_controller_spn_ad_attribute_filter`' + | `windows_ad_short_lived_domain_controller_spn_attribute_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` within `DS Access` needs to be enabled, alongside a SACL for `everybody` to diff --git a/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml similarity index 95% rename from detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml rename to detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index de8b8decfb..f560ab1d21 100644 --- a/detections/endpoint/windows_active_directory_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -1,4 +1,4 @@ -name: Windows Active Directory Same Domain SID History Addition +name: Windows AD Same Domain SID History Addition id: 5fde0b7c-df7a-40b1-9b3a-294c00f0289d version: 2 date: '2022-09-09' @@ -16,7 +16,7 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | where SidHistoryMatch=TargetSidmatch OR SidHistoryMatch=TargetDomainName | rename TargetSid as userSid, TargetDomainName as userDomainName | table _time action status host user userSid userDomainName SidHistory Logon_ID src_user - | `windows_active_directory_same_domain_sid_history_addition_filter`' + | `windows_ad_same_domain_sid_history_addition_filter`' how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` diff --git a/tests/endpoint/windows_active_directory_sid_history_addition.test.yml b/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml similarity index 54% rename from tests/endpoint/windows_active_directory_sid_history_addition.test.yml rename to tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml index 6b680dc9a4..7ecc09644c 100644 --- a/tests/endpoint/windows_active_directory_sid_history_addition.test.yml +++ b/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml @@ -1,7 +1,7 @@ -name: Windows Active Directory SID History Addition Unit Test +name: Windows AD Cross Domain SID History Addition Unit Test tests: -- name: Windows Active Directory SID History Addition - file: endpoint/windows_active_directory_sid_history_addition.yml +- name: Windows AD Cross Domain SID History Addition + file: endpoint/windows_ad_cross_domain_sid_history_addition.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml b/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml new file mode 100644 index 0000000000..b40b014ca4 --- /dev/null +++ b/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml @@ -0,0 +1,13 @@ +name: Windows AD Domain Replication ACL Addition Unit Test +tests: +- name: Windows AD Domain Replication ACL Addition + file: endpoint/windows_ad_domain_replication_acl_addition.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true diff --git a/tests/endpoint/windows_dsrm_account_changes.test.yml b/tests/endpoint/windows_ad_dsrm_account_changes.test.yml similarity index 74% rename from tests/endpoint/windows_dsrm_account_changes.test.yml rename to tests/endpoint/windows_ad_dsrm_account_changes.test.yml index b4a3c000e9..4cb26cc417 100644 --- a/tests/endpoint/windows_dsrm_account_changes.test.yml +++ b/tests/endpoint/windows_ad_dsrm_account_changes.test.yml @@ -1,7 +1,7 @@ -name: DSRM Account Changes Unit Test +name: Windows AD DSRM Account Changes Unit Test tests: -- name: DSRM Account Changes - file: endpoint/dsrm_account_changes.yml +- name: Windows AD DSRM Account Changes + file: endpoint/windows_ad_dsrm_account_changes.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_dsrm_password_reset.test.yml b/tests/endpoint/windows_ad_dsrm_password_reset.test.yml similarity index 74% rename from tests/endpoint/windows_dsrm_password_reset.test.yml rename to tests/endpoint/windows_ad_dsrm_password_reset.test.yml index c962d3acec..dee73e24ff 100644 --- a/tests/endpoint/windows_dsrm_password_reset.test.yml +++ b/tests/endpoint/windows_ad_dsrm_password_reset.test.yml @@ -1,7 +1,7 @@ -name: DSRM Password Reset Unit Test +name: Windows AD DSRM Password Reset Unit Test tests: -- name: DSRM Password Reset - file: endpoint/dsrm_password_reset.yml +- name: Windows AD DSRM Password Reset + file: endpoint/windows_ad_dsrm_password_reset.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.test.yml b/tests/endpoint/windows_ad_lived_domain_controller_spn_attribute.test.yml similarity index 65% rename from tests/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.test.yml rename to tests/endpoint/windows_ad_lived_domain_controller_spn_attribute.test.yml index a463e80413..4c4617769f 100644 --- a/tests/endpoint/windows_short_lived_domain_controller_spn_ad_attribute.test.yml +++ b/tests/endpoint/windows_ad_lived_domain_controller_spn_attribute.test.yml @@ -1,7 +1,7 @@ -name: Windows DCShadow Attack Unit Test +name: Windows AD Short Lived Domain Controller SPN Attribute Unit Test tests: -- name: Windows DCShadow Attack - file: endpoint/windows_dcshadow_attack.yml +- name: Windows AD Short Lived Domain Controller SPN Attribute + file: endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_active_directory_same_domain_sid_history_addition.test.yml b/tests/endpoint/windows_ad_same_domain_sid_history_addition.test.yml similarity index 69% rename from tests/endpoint/windows_active_directory_same_domain_sid_history_addition.test.yml rename to tests/endpoint/windows_ad_same_domain_sid_history_addition.test.yml index 508c50d1d0..ffcc53cdcd 100644 --- a/tests/endpoint/windows_active_directory_same_domain_sid_history_addition.test.yml +++ b/tests/endpoint/windows_ad_same_domain_sid_history_addition.test.yml @@ -1,7 +1,7 @@ -name: Windows Active Directory SID History Abuse Unit Test +name: Windows AD Same Domain SID History Addition Unit Test tests: -- name: Windows Active Directory SID History Abuse - file: endpoint/windows_active_directory_sid_history_abuse.yml +- name: Windows AD Same Domain SID History Addition + file: endpoint/windows_ad_same_domain_sid_history_addition.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From c315071aa636b3781c280712798c0c5b593295f1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 18 Nov 2022 13:30:17 -0500 Subject: [PATCH 55/90] adding new detection --- ...s_ad_cross_domain_sid_history_addition.yml | 9 +-- ...eprincipalname_added_to_domain_account.yml | 6 +- ...ed_domain_account_serviceprincipalname.yml | 65 +++++++++++++++++++ ...main_account_serviceprincipalname.test.yml | 13 ++++ 4 files changed, 82 insertions(+), 11 deletions(-) create mode 100644 detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml create mode 100644 tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 6f13eba36b..810301dded 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -7,8 +7,7 @@ type: TTP datamodel: [] description: The following analytic looks for changes to the sIDHistory AD attribute of user or computer objects within different domains. The SID history AD attribute allows users to inherit permissions from a separate AD account without group changes. Initially developed for access -<<<<<<< HEAD:detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml - continuity when migrating user accounts to different domains, this attribute can be abused for inter-domain privilege escalation and persistence. + continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries for inter-domain privilege escalation and persistence. search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistory IN ("%%1793", -) | rex field=SidHistory "(^%{|^)(?P.*)(\-|\\\)" | rex field=TargetSid "^(?P.*)(\-|\\\)" @@ -16,12 +15,6 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor | rename TargetSid as userSid | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_ad_cross_domain_sid_history_addition_filter`' -======= - continuity when migrating user accounts to different domains, this attribute can also be abused by adversaries for inter-domain privilege escalation and persistence. -search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) (SidHistory!="%%1793" AND SidHistory!="-") - | rename TargetSid as userSid - | table _time action status host user userSid SidHistory Logon_ID src_user | `windows_active_directory_sid_history_addition_filter`' ->>>>>>> refs/remotes/origin/TR_2410_Domain_Controller_Attacks:detections/endpoint/windows_active_directory_sid_history_addition.yml how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml index 0ddc580b98..b67bb56d5a 100644 --- a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml +++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml @@ -9,9 +9,9 @@ description: tbd search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName OperationType="%%14674" | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue | `windows_ad_serviceprincipalname_added_to_domain_account_filter`' -how_to_implement: To successfully implement this search, you ned to be ingesting Event codes - `5137` and `5141`. The Advanced Security Audit policy setting `Audit Directory Services Changes` - within `DS Access` needs to be enabled. For these event codes to be generated, specific SACLs are required. +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications. known_false_positives: A Service Principal Name should only be added to an account when an application requires it. While infrequent, this detection may trigger on legitimate actions. Filter as needed. references: diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml new file mode 100644 index 0000000000..7d115069b3 --- /dev/null +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -0,0 +1,65 @@ +name: Windows AD Short Lived Domain Account ServicePrincipalName +id: b681977c-d90c-4efc-81a5-c58f945fb541 +version: 1 +date: '2022-11-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: UPDATE_DESCRIPTION +search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName + | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675") + | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`' +how_to_implement: To successfully implement this search, you ned to be ingesting eventcode + `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` + within `DS Access` needs to be enabled. Additionally, a SACL needs to be created for AD objects in order to ingest attribute modifications. +known_false_positives: A Service Principal Name should only be added to an account when an application requires it. Adding an SPN and quickly deleting it + is less common but may be part of legitimate action. Filter as needed. +references: +- https://adsecurity.org/?p=3466 +- https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security.log + impact: 50 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A Servince Principal Name for $ObjectDN$ was set and shortly deleted + mitre_attack_id: + - T1098 + nist: + - DE.CM + observable: + - name: SubjectUserName + type: User + role: + - Attacker + - name: ObjectDN + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ObjectDN + - signature + - SubjectUserName + - Computer + risk_score: 40 + security_domain: endpoint diff --git a/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml b/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml new file mode 100644 index 0000000000..f1fed5d9fb --- /dev/null +++ b/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml @@ -0,0 +1,13 @@ +name: Windows AD Short Lived Domain Account ServicePrincipalName Unit Test +tests: +- name: Windows AD Short Lived Domain Account ServicePrincipalName + file: endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: UPDATE + data: UPDATE + source: UPDATE + sourcetype: UPDATE + update_timestamp: true From 00b818a97bcd1d21581b40f57f8ce1d04c7d88ad Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 18 Nov 2022 14:13:46 -0500 Subject: [PATCH 56/90] adding descriptions --- ...ws_ad_serviceprincipalname_added_to_domain_account.yml | 6 +++++- ...ad_short_lived_domain_account_serviceprincipalname.yml | 8 +++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml index b67bb56d5a..a71420e01e 100644 --- a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml +++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml @@ -5,7 +5,10 @@ date: '2022-11-17' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: tbd +description: The following analytic identifies the addition of a Service Principal Name to a domain account. While this event may be part of a legitimate action part of certain administrative operations, + it may also be evidence of a persistence attack. Domain accounts with Servce Principal Names are vulnerable to a technique called Kerberoasting that enables attackers to potentially obtain the cleartext password + of the account by performing offline cracking. An adversary who has obtained privileged access to a domain environment may add an SPN to a privileged account to then leverage the Kerberoasting technique and attempt + to obtain its clertext password. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName OperationType="%%14674" | stats values(ObjectDN) by _time, Computer, SubjectUserName, AttributeValue | `windows_ad_serviceprincipalname_added_to_domain_account_filter`' @@ -18,6 +21,7 @@ references: - https://adsecurity.org/?p=3466 - https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting tags: analytic_story: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/service_principal_name_added/windows-security.log diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index 7d115069b3..c36106f2fc 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -5,9 +5,14 @@ date: '2022-11-18' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: UPDATE_DESCRIPTION +description: The following analytic identifies the addition of a Service Principal Name to a domain account that is quickly deleted within 5 minutes or less. While this event may be part of a legitimate action part of certain administrative operations, + it may also be evidence of a persistence attack. Domain accounts with Servce Principal Names are vulnerable to a technique called Kerberoasting that enables attackers to potentially obtain the cleartext password + of the account by performing offline cracking. An adversary who has obtained privileged access to a domain environment may add an SPN to a privileged account to then leverage the Kerberoasting technique and attempt + to obtain its clertext password. To clean things up, the adversary may delete the SPN which will trigger this detection. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName | transaction ObjectDN AttributeValue startswith=(EventCode=5136 OperationType="%%14674") endswith=(EventCode=5136 OperationType="%%14675") + | eval short_lived=case((duration<300),"TRUE") + | search short_lived = TRUE | `windows_ad_short_lived_domain_account_serviceprincipalname_filter`' how_to_implement: To successfully implement this search, you ned to be ingesting eventcode `5136`. The Advanced Security Audit policy setting `Audit Directory Services Changes` @@ -18,6 +23,7 @@ references: - https://adsecurity.org/?p=3466 - https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136 +- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting tags: analytic_story: - Windows Domain Controller Attacks From 49960143bd1876b677183406d233930b6af6f655 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Sat, 19 Nov 2022 09:47:31 +1000 Subject: [PATCH 57/90] renames, updated descriptions and SPL --- ..._request_initiated_from_unsanctioned_location.yml | 12 ++++++------ ..._short_lived_domain_controller_spn_attribute.yml} | 0 ....yml => windows_ad_short_lived_server_object.yml} | 0 ...t_lived_domain_controller_spn_attribute.test.yml} | 0 4 files changed, 6 insertions(+), 6 deletions(-) rename detections/endpoint/{windows_ad_lived_domain_controller_spn_attribute.yml => windows_ad_short_lived_domain_controller_spn_attribute.yml} (100%) rename detections/endpoint/{windows_ad_short_lived_ad_server_object.yml => windows_ad_short_lived_server_object.yml} (100%) rename tests/endpoint/{windows_ad_lived_domain_controller_spn_attribute.test.yml => windows_ad_short_lived_domain_controller_spn_attribute.test.yml} (100%) diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index ee9c07fc9e..38c68957e2 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -5,15 +5,15 @@ date: '2022-11-17' author: Dean Luxton type: TTP datamodel: [] -description: This alert was written to detect activity associated with the DCSync attack. - When a domain controller receives a replication request, the user account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. +description: This alert was written to detect activity associated with the DCSync attack performed by computer accounts. + When a domain controller receives a replication request, the account permissions are validated, however no checks are performed to validate the request was initiated by a Domain Controller. Once an attacker gains control of an account with the necessary privileges, they can request password hashes for any or all users within the domain. - This alert detects when any AD account creates a handle to domainDNS with the necessary replication permissions. These requests are then filtered to exclude where the events originate - from a known domain controller IP address. Note, this detection is viable for detecting DCSync attacks performed using computer accounts. + This alert detects when a computer account account creates a handle to domainDNS with the necessary replication permissions. These requests are then filtered to exclude where the events originate + from a known domain controller IP address. search: '`wineventlog_security` EventCode=4662 ObjectType IN ("%{19195a5b-6da0-11d0-afd3-00c04fd930c9}", "domainDNS") AND Properties IN ("*Replicating Directory Changes All*", "*{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}*", "*{9923a32a-3607-11d2-b9be-0000f87a36b2}*","*{1131f6ac-9c07-11d1-f79f-00c04fc2dcd2}*") - AND AccessMask="0x100" + AND AccessMask="0x100" AND (SubjectUserSid="NT AUT*" OR SubjectUserSid="S-1-5-18" OR SubjectDomainName="Window Manager" OR SubjectUserName="*$") | stats min(_time) as attack_time, count by SubjectDomainName, SubjectUserName, Computer, Logon_ID, ObjectName, ObjectServer, ObjectType, OperationType, status @@ -38,7 +38,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin and all descendant objects. The principals `everybody`, `Domain Computers`, and `Domain Controllers` auditing the permissions `Replicating Directory Changes`, `Replicating Directory Changes All`, and `Replicating Directory Changes In Filtered Set` - Assets and Identities will also need to be configured, with the category of domain_controller added for genuine DCs. + Assets and Identities will also need to be configured, with the category of domain_controller added for domain controllers. known_false_positives: Genuine DC promotion may trigger this alert. references: - https://adsecurity.org/?p=1729 diff --git a/detections/endpoint/windows_ad_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml similarity index 100% rename from detections/endpoint/windows_ad_lived_domain_controller_spn_attribute.yml rename to detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml diff --git a/detections/endpoint/windows_ad_short_lived_ad_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml similarity index 100% rename from detections/endpoint/windows_ad_short_lived_ad_server_object.yml rename to detections/endpoint/windows_ad_short_lived_server_object.yml diff --git a/tests/endpoint/windows_ad_lived_domain_controller_spn_attribute.test.yml b/tests/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.test.yml similarity index 100% rename from tests/endpoint/windows_ad_lived_domain_controller_spn_attribute.test.yml rename to tests/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.test.yml From c6aae77bd6d871503445619b6ea263213cc1f674 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 25 Jan 2023 18:33:40 -0500 Subject: [PATCH 58/90] adding new detection from Steven Dick --- ...eprincipalname_added_to_domain_account.yml | 2 +- ...windows_ad_replication_service_traffic.yml | 72 +++++++++++++++++++ 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 detections/experimental/network/windows_ad_replication_service_traffic.yml diff --git a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml index a71420e01e..c0a7a9b437 100644 --- a/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml +++ b/detections/endpoint/windows_ad_serviceprincipalname_added_to_domain_account.yml @@ -35,7 +35,7 @@ tags: - Source:Endpoint - Stage:Persistence dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/service_principal_name_added/windows-security.log impact: 60 kill_chain_phases: - Installation diff --git a/detections/experimental/network/windows_ad_replication_service_traffic.yml b/detections/experimental/network/windows_ad_replication_service_traffic.yml new file mode 100644 index 0000000000..ef95d459b8 --- /dev/null +++ b/detections/experimental/network/windows_ad_replication_service_traffic.yml @@ -0,0 +1,72 @@ +name: Windows AD Replication Service Traffic +id: c6e24183-a5f4-4b2a-ad01-2eb456d09b67 +version: 1 +date: '2022-11-26' +author: Steven Dick +type: TTP +datamodel: +- Network_Traffic +- Network_Sessions +description: This search looks for evidence of Active Directory replication traffic [MS-DRSR] from unexpected sources. + This traffic is often seen exclusively between Domain Controllers for AD database replication. + Any detections from non-domain controller source to a domain controller may indicate the usage of DCSync or DCShadow credential dumping techniques. +search: ' | tstats `security_content_summariesonly` count values(All_Traffic.transport) as transport values(All_Traffic.user) as user + values(All_Traffic.src_category) as src_category values(All_Traffic.dest_category) as dest_category min(_time) as firstTime max(_time) as lastTime + from datamodel=Network_Traffic where All_Traffic.app IN ("ms-dc-replication","*drsr*","ad drs") by All_Traffic.src All_Traffic.dest All_Traffic.app + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name("All_Traffic")` + | `active_directory_replication_traffic_from_unknown_source_filter` + | `windows_ad_replication_service_traffic_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + application aware firewall or proxy logs into the Network Datamodel. Categorize + all known domain controller Assets servers with an appropriate category for filtering. +known_false_positives: New domain controllers or certian scripts run by administrators. +references: +- https://adsecurity.org/?p=1729 +- https://attack.mitre.org/techniques/T1003/006/ +- https://attack.mitre.org/techniques/T1207/ +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Credential Access + dataset: + - UPDATE_DATASET_URL + impact: 100 + kill_chain_phases: + - Exploitation + - Actions on Objectives + message: Active Directory Replication Traffic from Unknown Source - $src$ + mitre_attack_id: + - T1003 + - T1003.006 + - T1207 + nist: + - DE.CM + observable: + - name: dest + type: IP Address + role: + - Victim + - name: src + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - All_Traffic.src + - All_Traffic.dest + - All_Traffic.app + risk_score: 100 + security_domain: network From 50b884c8d157b768af4937e75d146b2e41df10d7 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 26 Jan 2023 11:54:08 +1000 Subject: [PATCH 59/90] Adding new Detection for DC Promo Events --- ...windows_ad_domain_controller_promotion.yml | 69 +++++++++++++++++++ ...ws_ad_domain_controller_promotion.test.yml | 13 ++++ 2 files changed, 82 insertions(+) create mode 100644 detections/endpoint/windows_ad_domain_controller_promotion.yml create mode 100644 tests/endpoint/windows_ad_domain_controller_promotion.test.yml diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml new file mode 100644 index 0000000000..91b71cf1b8 --- /dev/null +++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml @@ -0,0 +1,69 @@ +name: Windows AD Domain Controller Promotion +id: e633a0ef-2a6e-4ed7-b925-5ff999e5d1f0 +version: 1 +date: '2023-01-26' +author: Dean Luxton +type: TTP +datamodel: [] +description: This analytic identifies a genuine DC promotion event. Identifying when a computer assigns itself the + necessary SPNs to function as a domain controller. Note these events are triggered on the existing domain controllers, not the newly + joined domain controller. This detection will serve to identify rogue DCs added to the network. There are 2x detections within this analytic story + which identify DCShadow attacks, if you do not currently possess the logging for these detections, remove the where clause within this + detection to identify DCShadow activity. +search: "`wineventlog_security` EventCode=4742 ServicePrincipalNames IN (\"*E3514235-4B06-11D1-AB04-00C04FC2DCD2/*\"\ + , \"*GC/*\") \n| stats min(_time) as _time latest(ServicePrincipalNames) as ServicePrincipalNames,\ + \ values(signature) as signature, values(src_user) as src_user, values(user) as\ + \ user by Logon_ID, dvc\n| where src_user=user\n| rename Logon_ID as TargetLogonId,\ + \ user as dest\n| appendpipe [| map search=\"search `wineventlog_security` EventCode=4624\ + \ TargetLogonId=$TargetLogonId$\" | fields - dest, dvc, signature]\n| stats min(_time)\ + \ as _time, values(TargetUserSid) as TargetUserSid, values(Target_Domain) as Target_Domain,\ + \ values(user) as user, values(status) as status, values(src_category) as src_category,\ + \ values(src_ip) as src_ip values(ServicePrincipalNames) as ServicePrincipalNames\ + \ values(signature) as signature values(dest) as dest values(dvc) as dvc by TargetLogonId\n\ + | eval dest=trim(dest,\"$\") | `windows_ad_domain_controller_promotion_filter`" +how_to_implement: To successfully implement this search, you need to be ingesting eventcode + `4742`. The Advanced Security Audit policy setting `Audit Computer Account Management` + within `Account Management` needs to be enabled. +known_false_positives: None. +references: +- https://attack.mitre.org/techniques/T1207/ +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 7 + confidence: 100 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/dc_promo/windows-security-xml.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: AD Domain Controller Promotion Event Detected for $dest$ + mitre_attack_id: + - T1207 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ServicePrincipalNames + - src_user + - user + - Logon_ID + - dvc + risk_score: 80 + security_domain: endpoint diff --git a/tests/endpoint/windows_ad_domain_controller_promotion.test.yml b/tests/endpoint/windows_ad_domain_controller_promotion.test.yml new file mode 100644 index 0000000000..277852be84 --- /dev/null +++ b/tests/endpoint/windows_ad_domain_controller_promotion.test.yml @@ -0,0 +1,13 @@ +name: Windows AD Domain Controller Promotion Unit Test +tests: +- name: Windows AD Domain Controller Promotion + file: endpoint/windows_ad_domain_controller_promotion.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1207/dc_promo/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: true From cc55d3abb57dd0e499c350687e0c46aecd9f5ce3 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 26 Jan 2023 13:01:37 +1000 Subject: [PATCH 60/90] Adding detection for disabling audit policy on a DC --- ...dows_ad_domain_controller_gpo_disabled.yml | 64 +++++++++++++++++ ...windows_ad_domain_controller_promotion.yml | 2 +- lookups/auditpolicyguids.csv | 69 +++++++++++++++++++ ...ad_domain_controller_gpo_disabled.test.yml | 13 ++++ 4 files changed, 147 insertions(+), 1 deletion(-) create mode 100644 detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml create mode 100644 lookups/auditpolicyguids.csv create mode 100644 tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml diff --git a/detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml b/detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml new file mode 100644 index 0000000000..55c0e78084 --- /dev/null +++ b/detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml @@ -0,0 +1,64 @@ +name: Windows AD Domain Controller GPO Disabled +id: fc3ccef1-60a4-4239-bd66-b279511b4d14 +version: 1 +date: '2023-01-26' +author: Dean Luxton +type: TTP +datamodel: [] +description: This analytic looks for audit group policies being disabled on a domain controller. +search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, + %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure + removed")) dest_category="domain_controller" + + | replace "%%8448" with "Success removed", "%%8450" with "Failure removed", "%%8448, + %%8450" with "Success removed, Failure removed" in AuditPolicyChanges + + | eval AuditPolicyChanges=coalesce(AuditPolicyChanges,Changes), SubcategoryGuid=coalesce(SubcategoryGuid,Subcategory_GUID) + + | stats min(_time) as _time values(host) as dest by AuditPolicyChanges SubcategoryGuid + + | lookup auditpolicyguids_lookup GUID as SubcategoryGuid OUTPUT Category SubCategory + | `windows_ad_domain_controller_gpo_disabled_filter`' +how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists + in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results + within the base search. +known_false_positives: Unknown +references: +- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719 +tags: + analytic_story: + - Windows Domain Controller Attacks + asset_type: Endpoint + cis20: + - CIS 4 + - CIS 6 + confidence: 60 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log + impact: 100 + kill_chain_phases: + - Actions on Objectives + message: GPO $SubCategory$ of $Category$ was disabled on $dest$ + mitre_attack_id: + - T1562.001 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - AuditPolicyChanges + - SubcategoryGuid + risk_score: 60 + security_domain: endpoint diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml index 91b71cf1b8..a0492d4d5c 100644 --- a/detections/endpoint/windows_ad_domain_controller_promotion.yml +++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml @@ -33,7 +33,7 @@ tags: asset_type: Endpoint cis20: - CIS 4 - - CIS 7 + - CIS 6 confidence: 100 context: - Source:Endpoint diff --git a/lookups/auditpolicyguids.csv b/lookups/auditpolicyguids.csv new file mode 100644 index 0000000000..646c8914a8 --- /dev/null +++ b/lookups/auditpolicyguids.csv @@ -0,0 +1,69 @@ +Category,SubCategory,GUID +System,,{69979848-797A-11D9-BED3-505054503030} +System,Security State Change,{0CCE9210-69AE-11D9-BED3-505054503030} +System,Security System Extension,{0CCE9211-69AE-11D9-BED3-505054503030} +System,System Integrity,{0CCE9212-69AE-11D9-BED3-505054503030} +System,IPsec Driver,{0CCE9213-69AE-11D9-BED3-505054503030} +System,Other System Events,{0CCE9214-69AE-11D9-BED3-505054503030} +Logon/Logoff,,{69979849-797A-11D9-BED3-505054503030} +Logon/Logoff,Logon,{0CCE9215-69AE-11D9-BED3-505054503030} +Logon/Logoff,Logoff,{0CCE9216-69AE-11D9-BED3-505054503030} +Logon/Logoff,Account Lockout,{0CCE9217-69AE-11D9-BED3-505054503030} +Logon/Logoff,IPsec Main Mode,{0CCE9218-69AE-11D9-BED3-505054503030} +Logon/Logoff,IPsec Quick Mode,{0CCE9219-69AE-11D9-BED3-505054503030} +Logon/Logoff,IPsec Extended Mode,{0CCE921A-69AE-11D9-BED3-505054503030} +Logon/Logoff,Special Logon,{0CCE921B-69AE-11D9-BED3-505054503030} +Logon/Logoff,Other Logon/Logoff Events,{0CCE921C-69AE-11D9-BED3-505054503030} +Logon/Logoff,Network Policy Server,{0CCE9243-69AE-11D9-BED3-505054503030} +Logon/Logoff,User / Device Claims,{0CCE9247-69AE-11D9-BED3-505054503030} +Logon/Logoff,Group Membership,{0CCE9249-69AE-11D9-BED3-505054503030} +Object Access,,{6997984A-797A-11D9-BED3-505054503030} +Object Access,File System,{0CCE921D-69AE-11D9-BED3-505054503030} +Object Access,Registry,{0CCE921E-69AE-11D9-BED3-505054503030} +Object Access,Kernel Object,{0CCE921F-69AE-11D9-BED3-505054503030} +Object Access,SAM,{0CCE9220-69AE-11D9-BED3-505054503030} +Object Access,Certification Services,{0CCE9221-69AE-11D9-BED3-505054503030} +Object Access,Application Generated,{0CCE9222-69AE-11D9-BED3-505054503030} +Object Access,Handle Manipulation,{0CCE9223-69AE-11D9-BED3-505054503030} +Object Access,File Share,{0CCE9224-69AE-11D9-BED3-505054503030} +Object Access,Filtering Platform Packet Drop,{0CCE9225-69AE-11D9-BED3-505054503030} +Object Access,Filtering Platform Connection,{0CCE9226-69AE-11D9-BED3-505054503030} +Object Access,Other Object Access Events,{0CCE9227-69AE-11D9-BED3-505054503030} +Object Access,Detailed File Share,{0CCE9244-69AE-11D9-BED3-505054503030} +Object Access,Removable Storage,{0CCE9245-69AE-11D9-BED3-505054503030} +Object Access,Central Policy Staging,{0CCE9246-69AE-11D9-BED3-505054503030} +Privilege Use,,{6997984B-797A-11D9-BED3-505054503030} +Privilege Use,Sensitive Privilege Use,{0CCE9228-69AE-11D9-BED3-505054503030} +Privilege Use,Non Sensitive Privilege Use,{0CCE9229-69AE-11D9-BED3-505054503030} +Privilege Use,Other Privilege Use Events,{0CCE922A-69AE-11D9-BED3-505054503030} +Detailed Tracking,,{6997984C-797A-11D9-BED3-505054503030} +Detailed Tracking,Process Creation,{0CCE922B-69AE-11D9-BED3-505054503030} +Detailed Tracking,Process Termination,{0CCE922C-69AE-11D9-BED3-505054503030} +Detailed Tracking,DPAPI Activity,{0CCE922D-69AE-11D9-BED3-505054503030} +Detailed Tracking,RPC Events,{0CCE922E-69AE-11D9-BED3-505054503030} +Detailed Tracking,Plug and Play Events,{0CCE9248-69AE-11D9-BED3-505054503030} +Detailed Tracking,Token Right Adjusted Events,{0CCE924A-69AE-11D9-BED3-505054503030} +Policy Change,,{6997984D-797A-11D9-BED3-505054503030} +Policy Change,Audit Policy Change,{0CCE922F-69AE-11D9-BED3-505054503030} +Policy Change,Authentication Policy Change,{0CCE9230-69AE-11D9-BED3-505054503030} +Policy Change,Authorization Policy Change,{0CCE9231-69AE-11D9-BED3-505054503030} +Policy Change,MPSSVC Rule-Level Policy Change,{0CCE9232-69AE-11D9-BED3-505054503030} +Policy Change,Filtering Platform Policy Change,{0CCE9233-69AE-11D9-BED3-505054503030} +Policy Change,Other Policy Change Events,{0CCE9234-69AE-11D9-BED3-505054503030} +Account Management,,{6997984E-797A-11D9-BED3-505054503030} +Account Management,User Account Management,{0CCE9235-69AE-11D9-BED3-505054503030} +Account Management,Computer Account Management,{0CCE9236-69AE-11D9-BED3-505054503030} +Account Management,Security Group Management,{0CCE9237-69AE-11D9-BED3-505054503030} +Account Management,Distribution Group Management,{0CCE9238-69AE-11D9-BED3-505054503030} +Account Management,Application Group Management,{0CCE9239-69AE-11D9-BED3-505054503030} +Account Management,Other Account Management Events,{0CCE923A-69AE-11D9-BED3-505054503030} +DS Access,,{6997984F-797A-11D9-BED3-505054503030} +DS Access,Directory Service Access,{0CCE923B-69AE-11D9-BED3-505054503030} +DS Access,Directory Service Changes,{0CCE923C-69AE-11D9-BED3-505054503030} +DS Access,Directory Service Replication,{0CCE923D-69AE-11D9-BED3-505054503030} +DS Access,Detailed Directory Service Replication,{0CCE923E-69AE-11D9-BED3-505054503030} +Account Logon,,{69979850-797A-11D9-BED3-505054503030} +Account Logon,Credential Validation,{0CCE923F-69AE-11D9-BED3-505054503030} +Account Logon,Kerberos Service Ticket Operations,{0CCE9240-69AE-11D9-BED3-505054503030} +Account Logon,Other Account Logon Events,{0CCE9241-69AE-11D9-BED3-505054503030} +Account Logon,Kerberos Authentication Service,{0CCE9242-69AE-11D9-BED3-505054503030} \ No newline at end of file diff --git a/tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml b/tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml new file mode 100644 index 0000000000..d8b132264c --- /dev/null +++ b/tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml @@ -0,0 +1,13 @@ +name: Windows AD Domain Controller GPO Disabled Unit Test +tests: +- name: Windows AD Domain Controller GPO Disabled + file: endpoint/windows_ad_domain_controller_gpo_disabled.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log + - file_name: windows-security-xml.log + data: + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: trueE From 4999f933e3e83f1ed978856e2e715fb206a2c410 Mon Sep 17 00:00:00 2001 From: dluxtron <106139814+dluxtron@users.noreply.github.com> Date: Thu, 26 Jan 2023 13:03:57 +1000 Subject: [PATCH 61/90] Adding detection for disabling audit policy on a DC --- ... windows_ad_domain_controller_audit_policy_disabled.yml} | 4 ++-- ...ows_ad_domain_controller_audit_policy_disabled.test.yml} | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) rename detections/endpoint/{windows_ad_domain_controller_gpo_disabled.yml => windows_ad_domain_controller_audit_policy_disabled.yml} (93%) rename tests/endpoint/{windows_ad_domain_controller_gpo_disabled.test.yml => windows_ad_domain_controller_audit_policy_disabled.test.yml} (67%) diff --git a/detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml similarity index 93% rename from detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml rename to detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 55c0e78084..7804e7f6d9 100644 --- a/detections/endpoint/windows_ad_domain_controller_gpo_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -1,11 +1,11 @@ -name: Windows AD Domain Controller GPO Disabled +name: Windows AD Domain Controller Audit Policy Disabled id: fc3ccef1-60a4-4239-bd66-b279511b4d14 version: 1 date: '2023-01-26' author: Dean Luxton type: TTP datamodel: [] -description: This analytic looks for audit group policies being disabled on a domain controller. +description: This analytic looks for audit policies being disabled on a domain controller. search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448","%%8450","%%8448, %%8450") OR Changes IN ("Failure removed","Success removed","Success removed, Failure removed")) dest_category="domain_controller" diff --git a/tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml b/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml similarity index 67% rename from tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml rename to tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml index d8b132264c..12c3b301d0 100644 --- a/tests/endpoint/windows_ad_domain_controller_gpo_disabled.test.yml +++ b/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml @@ -1,7 +1,7 @@ -name: Windows AD Domain Controller GPO Disabled Unit Test +name: Windows AD Domain Controller Audit Policy Disabled Unit Test tests: -- name: Windows AD Domain Controller GPO Disabled - file: endpoint/windows_ad_domain_controller_gpo_disabled.yml +- name: Windows AD Domain Controller Audit Policy Disabled + file: endpoint/windows_ad_domain_controller_audit_policy_disabled.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From a46c2117bb019f55ca62a5400252175e3e42e1cd Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Feb 2023 17:04:38 -0500 Subject: [PATCH 62/90] renaming analytic story --- detections/endpoint/windows_ad_adminsdholder_acl_modified.yml | 2 +- .../endpoint/windows_ad_cross_domain_sid_history_addition.yml | 2 +- .../windows_ad_domain_controller_audit_policy_disabled.yml | 2 +- .../endpoint/windows_ad_domain_controller_promotion.yml | 2 +- .../endpoint/windows_ad_domain_replication_acl_addition.yml | 2 +- detections/endpoint/windows_ad_dsrm_account_changes.yml | 2 +- detections/endpoint/windows_ad_dsrm_password_reset.yml | 2 +- ...ndows_ad_replication_request_initiated_by_user_account.yml | 2 +- ...plication_request_initiated_from_unsanctioned_location.yml | 2 +- .../endpoint/windows_ad_same_domain_sid_history_addition.yml | 2 +- ...ows_ad_short_lived_domain_account_serviceprincipalname.yml | 2 +- ...windows_ad_short_lived_domain_controller_spn_attribute.yml | 2 +- detections/endpoint/windows_ad_short_lived_server_object.yml | 2 +- .../endpoint/windows_ad_sid_history_attribute_modified.yml | 2 +- ...tive_directory_privileged_account_sid_history_addition.yml | 2 +- detections/experimental/network/rogue_dc_network_activity.yml | 2 +- .../network/windows_ad_replication_service_traffic.yml | 2 +- ...cks.yml => sneaky_active_directory_persistence_tricks.yml} | 4 ++-- 18 files changed, 19 insertions(+), 19 deletions(-) rename stories/{windows_domain_controller_attacks.yml => sneaky_active_directory_persistence_tricks.yml} (93%) diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index ace270bb4e..9218bbdecd 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -29,7 +29,7 @@ references: - https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-cd748e10950 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 810301dded..e88f948647 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -26,7 +26,7 @@ references: - https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unsecure-sid-history-attribute tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 7804e7f6d9..8e5807a6f7 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -27,7 +27,7 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_controller_promotion.yml b/detections/endpoint/windows_ad_domain_controller_promotion.yml index a0492d4d5c..dda3b1e0c4 100644 --- a/detections/endpoint/windows_ad_domain_controller_promotion.yml +++ b/detections/endpoint/windows_ad_domain_controller_promotion.yml @@ -29,7 +29,7 @@ references: - https://attack.mitre.org/techniques/T1207/ tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 6a7e961cc4..ff73722cfc 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -43,7 +43,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/29a5c62784faf986dc03952ae3e90e3df3294284/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 6 diff --git a/detections/endpoint/windows_ad_dsrm_account_changes.yml b/detections/endpoint/windows_ad_dsrm_account_changes.yml index 629776bbfc..934fe94634 100644 --- a/detections/endpoint/windows_ad_dsrm_account_changes.yml +++ b/detections/endpoint/windows_ad_dsrm_account_changes.yml @@ -32,7 +32,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Windows Registry Abuse - Windows Persistence Techniques asset_type: Endpoint diff --git a/detections/endpoint/windows_ad_dsrm_password_reset.yml b/detections/endpoint/windows_ad_dsrm_password_reset.yml index 6dd8b5ade5..3664351cc2 100644 --- a/detections/endpoint/windows_ad_dsrm_password_reset.yml +++ b/detections/endpoint/windows_ad_dsrm_password_reset.yml @@ -22,7 +22,7 @@ references: - https://adsecurity.org/?p=1714 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 6 diff --git a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml index 597b637a2d..928ba49bab 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_by_user_account.yml @@ -29,7 +29,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Credential Dumping asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml index 38c68957e2..54787ae31f 100644 --- a/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml +++ b/detections/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml @@ -46,7 +46,7 @@ references: - https://github.com/SigmaHQ/sigma/blob/0.22-699-g29a5c6278/rules/windows/builtin/security/win_security_dcsync.yml tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Credential Dumping asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index 047699ee87..8f2ed5bf6a 100644 --- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -29,7 +29,7 @@ references: - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks - Windows Persistence Techniques asset_type: Endpoint cis20: diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index c36106f2fc..c2547ed833 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -26,7 +26,7 @@ references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml index 373f6a70ee..e833fc8f8c 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_controller_spn_attribute.yml @@ -31,7 +31,7 @@ references: - https://blog.alsid.eu/dcshadow-explained-4510f52fc19d tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index 72e98b1d0a..ed5b2cf8c9 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -30,7 +30,7 @@ references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml index 3b828b08e8..d87b775222 100644 --- a/detections/endpoint/windows_ad_sid_history_attribute_modified.yml +++ b/detections/endpoint/windows_ad_sid_history_attribute_modified.yml @@ -22,7 +22,7 @@ references: - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml index a1e63ec3f2..45fe77440e 100644 --- a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml +++ b/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml @@ -28,7 +28,7 @@ references: - https://adsecurity.org/?p=1772 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/experimental/network/rogue_dc_network_activity.yml b/detections/experimental/network/rogue_dc_network_activity.yml index 9687b49ff4..960cd7222e 100644 --- a/detections/experimental/network/rogue_dc_network_activity.yml +++ b/detections/experimental/network/rogue_dc_network_activity.yml @@ -17,7 +17,7 @@ references: - https://adsecurity.org/?p=1729 tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 4 diff --git a/detections/experimental/network/windows_ad_replication_service_traffic.yml b/detections/experimental/network/windows_ad_replication_service_traffic.yml index ef95d459b8..3d862b148d 100644 --- a/detections/experimental/network/windows_ad_replication_service_traffic.yml +++ b/detections/experimental/network/windows_ad_replication_service_traffic.yml @@ -28,7 +28,7 @@ references: - https://attack.mitre.org/techniques/T1207/ tags: analytic_story: - - Windows Domain Controller Attacks + - Sneaky Active Directory Persistence Tricks asset_type: endpoint cis20: - CIS 3 diff --git a/stories/windows_domain_controller_attacks.yml b/stories/sneaky_active_directory_persistence_tricks.yml similarity index 93% rename from stories/windows_domain_controller_attacks.yml rename to stories/sneaky_active_directory_persistence_tricks.yml index 3b1a2ff073..bdeacbb607 100644 --- a/stories/windows_domain_controller_attacks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -1,8 +1,8 @@ -name: Windows Domain Controller Attacks +name: Sneaky Active Directory Persistence Tricks id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 1 date: '2022-08-29' -author: Dean Luxton, Mauricio Velazco +author: Dean Luxton, Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. From b8cc8fc3146bac29da4a6bff5094b6cf53b72ab2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 8 Feb 2023 17:28:31 -0500 Subject: [PATCH 63/90] update --- ...dows_ad_domain_controller_audit_policy_disabled.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml b/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml index 12c3b301d0..ea28d2a0f9 100644 --- a/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml +++ b/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml @@ -5,9 +5,9 @@ tests: pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now - attack_data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log + attack_data: - file_name: windows-security-xml.log - data: + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable_gpo/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: xmlwineventlog - update_timestamp: trueE + update_timestamp: true From 45605549370e5441281e7a42546e620543ad7c5d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 9 Feb 2023 14:30:05 -0500 Subject: [PATCH 64/90] fixing test files --- stories/sneaky_active_directory_persistence_tricks.yml | 6 ++++-- ...ndows_ad_cross_domain_sid_history_addition.test.yml | 10 +++++----- ...windows_ad_domain_replication_acl_addition.test.yml | 8 ++++---- ..._lived_domain_account_serviceprincipalname.test.yml | 8 ++++---- 4 files changed, 17 insertions(+), 15 deletions(-) diff --git a/stories/sneaky_active_directory_persistence_tricks.yml b/stories/sneaky_active_directory_persistence_tricks.yml index bdeacbb607..762e37ae5d 100644 --- a/stories/sneaky_active_directory_persistence_tricks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -3,8 +3,10 @@ id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco, Splunk -description: Monitor for activities and techniques associated with replication based attacks which target domain controllers and post-exploitation active directory persistence techniques. -narrative: This analytic story provides detections for some of the highest impact attacks which can be performed against an Active Directory network. +description: Monitor for activities and techniques associated with Windows Active Directory persistence techniques. +narrative: In 2015 AD security researcher Sean Metcalf published a blog post named Sneaky Active Directory Persistence Tricks. In this blog post, Sean described several methods through which an attacker could persist + administrative access to an Active Directory networki after having Domain Admin level rights for a short period of time. 8 years later, most of these techniques are still possible since they abuse legitimate administrative functionality. + This analytic story groups detection opportunities for most of the techniques described by Sean as well as other high impact attacks against Active Directory and Domain Controllers. Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. references: diff --git a/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml b/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml index 7ecc09644c..834dc84db9 100644 --- a/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml +++ b/tests/endpoint/windows_ad_cross_domain_sid_history_addition.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE - update_timestamp: true + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/mimikatz/windows-security-xml.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true \ No newline at end of file diff --git a/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml b/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml index b40b014ca4..bfb0f202af 100644 --- a/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml +++ b/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/aclmodification/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog update_timestamp: true diff --git a/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml b/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml index f1fed5d9fb..0e3107989b 100644 --- a/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml +++ b/tests/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/short_lived_service_principal_name/windows-security.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog update_timestamp: true From 2316d23444cedef3e381233e727b390470dac5e9 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 9 Feb 2023 15:06:03 -0500 Subject: [PATCH 65/90] fixing test file --- ..._initiated_from_unsanctioned_location.test.yml | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml index d1cf5ba192..91d9608390 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml @@ -1,13 +1,14 @@ -name: Windows Replication Event from Non-DC Computer Account Unit Test +name: Windows AD Replication Request Initiated from Unsanctioned Location Test tests: -- name: Windows Replication Event from Non-DC Computer Account - file: endpoint/windows_replication_event_from_non_dc_computer_account.yml +- name: Windows AD Replication Request Initiated from Unsanctioned Location + file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - - file_name: UPDATE - data: UPDATE - source: UPDATE - sourcetype: UPDATE + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog update_timestamp: true + From 377355412c914144dfe00b114b2b6af16f9d2ad0 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 9 Feb 2023 16:29:53 -0500 Subject: [PATCH 66/90] fixing filter name --- .../windows_ad_domain_controller_audit_policy_disabled.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 8e5807a6f7..9250d7dd36 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -18,7 +18,7 @@ search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448", | stats min(_time) as _time values(host) as dest by AuditPolicyChanges SubcategoryGuid | lookup auditpolicyguids_lookup GUID as SubcategoryGuid OUTPUT Category SubCategory - | `windows_ad_domain_controller_gpo_disabled_filter`' + | `windows_ad_domain_controller_audit_policy_disabled_filter`' how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results within the base search. From cba65f42f4d47634ff2f15aef88683e463786dc7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Feb 2023 12:38:07 -0500 Subject: [PATCH 67/90] fixing name --- ...ws_ad_replication_request_initiated_by_user_account.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index a40a7e0eb9..e03304570b 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,7 +1,7 @@ name: DCSync Attack Unit Test tests: - name: DCSync Attack - file: endpoint/dcsync_attack.yml + file: endpoint/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 4788c1297976cf7b071b93a093198bec206bf8d2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Feb 2023 12:55:26 -0500 Subject: [PATCH 68/90] update macro --- macros/wineventlog_security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/wineventlog_security.yml b/macros/wineventlog_security.yml index 00d2e3d6b8..65bed12450 100644 --- a/macros/wineventlog_security.yml +++ b/macros/wineventlog_security.yml @@ -1,4 +1,4 @@ -definition: eventtype=wineventlog_security +definition: eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: wineventlog_security From 40dc6a504fdb1481656a7320cdafd56e733b3a2c Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Feb 2023 14:17:15 -0500 Subject: [PATCH 69/90] fixing detection name in test file --- ..._ad_replication_request_initiated_by_user_account.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index e03304570b..4df3a000c4 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,6 +1,6 @@ -name: DCSync Attack Unit Test +name: Windows AD Replication Request Initiated by User Account Test tests: -- name: DCSync Attack +- name: Windows AD Replication Request Initiated by User Account file: endpoint/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h From 4f2307f6c6b41ccf9c02a126655ed8aeab25e1db Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 13 Feb 2023 12:03:49 -0500 Subject: [PATCH 70/90] renaming advanced audit policy guids lookup --- .../windows_ad_domain_controller_audit_policy_disabled.yml | 2 +- ...uditpolicyguids.csv => advanced_audit_policy_guids.csv} | 0 lookups/advanced_audit_policy_guids.yml | 7 +++++++ 3 files changed, 8 insertions(+), 1 deletion(-) rename lookups/{auditpolicyguids.csv => advanced_audit_policy_guids.csv} (100%) create mode 100644 lookups/advanced_audit_policy_guids.yml diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml index 9250d7dd36..a40e4e2f62 100644 --- a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml +++ b/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml @@ -17,7 +17,7 @@ search: '`wineventlog_security` EventCode=4719 (AuditPolicyChanges IN ("%%8448", | stats min(_time) as _time values(host) as dest by AuditPolicyChanges SubcategoryGuid - | lookup auditpolicyguids_lookup GUID as SubcategoryGuid OUTPUT Category SubCategory + | lookup advanced_audit_policy_guids GUID as SubcategoryGuid OUTPUT Category SubCategory | `windows_ad_domain_controller_audit_policy_disabled_filter`' how_to_implement: Ensure you are ingesting EventCode `4719` from your domain controllers, the category domain_controller exists in assets and identities, and that assets and identities is enabled. If A&I is not configured, you will need to manually filter the results diff --git a/lookups/auditpolicyguids.csv b/lookups/advanced_audit_policy_guids.csv similarity index 100% rename from lookups/auditpolicyguids.csv rename to lookups/advanced_audit_policy_guids.csv diff --git a/lookups/advanced_audit_policy_guids.yml b/lookups/advanced_audit_policy_guids.yml new file mode 100644 index 0000000000..37b6e854af --- /dev/null +++ b/lookups/advanced_audit_policy_guids.yml @@ -0,0 +1,7 @@ +description: List of GUIDs associated with Windows advanced audit policies +filename: advanced_audit_policy_guids.csv +name: advanced_audit_policy_guids +default_match: 'false' +match_type: WILDCARD(GUID) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file From 46301701ac9c86c1a3e0e42da0845ff28606e379 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 13 Feb 2023 15:25:30 -0500 Subject: [PATCH 71/90] updating analytic story narrative --- ...ky_active_directory_persistence_tricks.yml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/stories/sneaky_active_directory_persistence_tricks.yml b/stories/sneaky_active_directory_persistence_tricks.yml index 762e37ae5d..9127767a66 100644 --- a/stories/sneaky_active_directory_persistence_tricks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -4,13 +4,22 @@ version: 1 date: '2022-08-29' author: Dean Luxton, Mauricio Velazco, Splunk description: Monitor for activities and techniques associated with Windows Active Directory persistence techniques. -narrative: In 2015 AD security researcher Sean Metcalf published a blog post named Sneaky Active Directory Persistence Tricks. In this blog post, Sean described several methods through which an attacker could persist - administrative access to an Active Directory networki after having Domain Admin level rights for a short period of time. 8 years later, most of these techniques are still possible since they abuse legitimate administrative functionality. - This analytic story groups detection opportunities for most of the techniques described by Sean as well as other high impact attacks against Active Directory and Domain Controllers. - Featuring attacks which leverage flaws within replication (MS probably wont fix these any time soon), enabling backdoor accounts and other stealthy persistence techniques. - It is imperative to enable the necessary GPOs and SACLs required, otherwise the eventcodes will not trigger. Each detection includes a list of requirements for enabling logging. +narrative: Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. + Active Directory is a centralized and hierarchical database that stores information about users, computers, and other resources on a network. It provides secure and efficient management + of these resources and enables administrators to enforce security policies and delegate administrative tasks.\ + + In 2015 Active Directory security researcher Sean Metcalf published a blog post titled `Sneaky Active Directory Persistence Tricks`. In this blog post, + Sean described several methods through which an attacker could persist administrative access on an Active Directory network after having Domain Admin level rights for + a short period of time. At the time of writing, 8 years after the initial blog post, most of these techniques are still possible since they abuse legitimate administrative functionality and not software vulnerabilities. + Security engineers defending Active Directory networks should be aware of these technique available to adversaries post exploitation and deploy both preventive and detective security controls for them.\ + + This analytic story groups detection opportunities for most of the techniques described on Seans blog post as well as other high impact attacks against Active Directory networks and Domain Controllers. + For some of these detection opportunities, it is necessary to enable the necessary GPOs and SACLs required, otherwise the event codes will not trigger. Each detection includes a list of requirements for enabling logging. references: - https://adsecurity.org/?p=1929 + - https://www.youtube.com/watch?v=Lz6haohGAMc&feature=youtu.be + - https://adsecurity.org/wp-content/uploads/2015/09/DEFCON23-2015-Metcalf-RedvsBlue-ADAttackAndDefense-Final.pdf + - https://attack.mitre.org/tactics/TA0003/ - https://www.dcshadow.com - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2 - https://www.linkedin.com/pulse/mimikatz-dcsync-event-log-detections-john-dwyer From b6b7f811b14c46a627d5ac376bcf9250bc1b5031 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 13 Feb 2023 15:56:07 -0500 Subject: [PATCH 72/90] moving detections to experimental --- ...ndows_ad_short_lived_domain_account_serviceprincipalname.yml | 2 +- .../windows_ad_domain_controller_audit_policy_disabled.yml | 0 .../windows_ad_domain_replication_acl_addition.yml | 0 3 files changed, 1 insertion(+), 1 deletion(-) rename detections/{endpoint => experimental}/windows_ad_domain_controller_audit_policy_disabled.yml (100%) rename detections/{endpoint => experimental}/windows_ad_domain_replication_acl_addition.yml (100%) diff --git a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml index c2547ed833..00364ccf19 100644 --- a/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml +++ b/detections/endpoint/windows_ad_short_lived_domain_account_serviceprincipalname.yml @@ -6,7 +6,7 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: The following analytic identifies the addition of a Service Principal Name to a domain account that is quickly deleted within 5 minutes or less. While this event may be part of a legitimate action part of certain administrative operations, - it may also be evidence of a persistence attack. Domain accounts with Servce Principal Names are vulnerable to a technique called Kerberoasting that enables attackers to potentially obtain the cleartext password + it may also be evidence of a persistence attack. Domain accounts with Service Principal Names are vulnerable to a technique called Kerberoasting that enables attackers to potentially obtain the cleartext password of the account by performing offline cracking. An adversary who has obtained privileged access to a domain environment may add an SPN to a privileged account to then leverage the Kerberoasting technique and attempt to obtain its clertext password. To clean things up, the adversary may delete the SPN which will trigger this detection. search: ' `wineventlog_security` EventCode=5136 AttributeLDAPDisplayName=servicePrincipalName diff --git a/detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/experimental/windows_ad_domain_controller_audit_policy_disabled.yml similarity index 100% rename from detections/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml rename to detections/experimental/windows_ad_domain_controller_audit_policy_disabled.yml diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/experimental/windows_ad_domain_replication_acl_addition.yml similarity index 100% rename from detections/endpoint/windows_ad_domain_replication_acl_addition.yml rename to detections/experimental/windows_ad_domain_replication_acl_addition.yml From b07c7cff05e6884911c32c2cb5708b607de0503d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 13 Feb 2023 16:10:56 -0500 Subject: [PATCH 73/90] updating names and moving to experimental --- .../windows_ad_domain_controller_audit_policy_disabled.yml | 0 .../windows_ad_domain_replication_acl_addition.yml | 0 ...windows_ad_rogue_domain_controller_network_activity.yml} | 2 +- ...dows_ad_domain_controller_audit_policy_disabled.test.yml | 0 .../windows_ad_domain_replication_acl_addition.test.yml | 0 ...windows_ad_rogue_domain_controller_network_activity.yml} | 6 +++--- 6 files changed, 4 insertions(+), 4 deletions(-) rename detections/experimental/{ => endpoint}/windows_ad_domain_controller_audit_policy_disabled.yml (100%) rename detections/experimental/{ => endpoint}/windows_ad_domain_replication_acl_addition.yml (100%) rename detections/experimental/network/{rogue_dc_network_activity.yml => windows_ad_rogue_domain_controller_network_activity.yml} (96%) rename tests/{ => experimental}/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml (100%) rename tests/{ => experimental}/endpoint/windows_ad_domain_replication_acl_addition.test.yml (100%) rename tests/experimental/network/{rogue_dc_network_activity.test.yml => windows_ad_rogue_domain_controller_network_activity.yml} (65%) diff --git a/detections/experimental/windows_ad_domain_controller_audit_policy_disabled.yml b/detections/experimental/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml similarity index 100% rename from detections/experimental/windows_ad_domain_controller_audit_policy_disabled.yml rename to detections/experimental/endpoint/windows_ad_domain_controller_audit_policy_disabled.yml diff --git a/detections/experimental/windows_ad_domain_replication_acl_addition.yml b/detections/experimental/endpoint/windows_ad_domain_replication_acl_addition.yml similarity index 100% rename from detections/experimental/windows_ad_domain_replication_acl_addition.yml rename to detections/experimental/endpoint/windows_ad_domain_replication_acl_addition.yml diff --git a/detections/experimental/network/rogue_dc_network_activity.yml b/detections/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml similarity index 96% rename from detections/experimental/network/rogue_dc_network_activity.yml rename to detections/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml index 960cd7222e..fb8a711cbd 100644 --- a/detections/experimental/network/rogue_dc_network_activity.yml +++ b/detections/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml @@ -1,4 +1,4 @@ -name: Rogue DC Network Activity +name: Windows AD Rogue Domain Controller Network Activity id: c4aeeeef-da7f-4338-b3ba-553cbcbe2138 version: 1 date: '2022-09-08' diff --git a/tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml b/tests/experimental/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml similarity index 100% rename from tests/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml rename to tests/experimental/endpoint/windows_ad_domain_controller_audit_policy_disabled.test.yml diff --git a/tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml b/tests/experimental/endpoint/windows_ad_domain_replication_acl_addition.test.yml similarity index 100% rename from tests/endpoint/windows_ad_domain_replication_acl_addition.test.yml rename to tests/experimental/endpoint/windows_ad_domain_replication_acl_addition.test.yml diff --git a/tests/experimental/network/rogue_dc_network_activity.test.yml b/tests/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml similarity index 65% rename from tests/experimental/network/rogue_dc_network_activity.test.yml rename to tests/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml index 71e9d913f1..36f995790f 100644 --- a/tests/experimental/network/rogue_dc_network_activity.test.yml +++ b/tests/experimental/network/windows_ad_rogue_domain_controller_network_activity.yml @@ -1,7 +1,7 @@ -name: Rogue DC Network Activity Unit Test +name: Windows AD Rogue Domain Controller Network Activity Unit Test tests: -- name: Rogue DC Network Activity - file: network/rogue_dc_network_activity.yml +- name: Windows AD Rogue Domain Controller Network Activity + file: network/windows_ad_rogue_domain_controller_network_activity.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 121d1e3114237d5676636d0b91bf6c44618824df Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 15 Feb 2023 14:52:31 -0500 Subject: [PATCH 74/90] update story description --- detections/endpoint/registry_keys_used_for_persistence.yml | 1 + .../endpoint/windows_security_support_provider_reg_query.yml | 1 + stories/sneaky_active_directory_persistence_tricks.yml | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 7cf8f71de9..888d484319 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -57,6 +57,7 @@ tags: - Qakbot - Chaos Ransomware - AsyncRAT + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/windows_security_support_provider_reg_query.yml b/detections/endpoint/windows_security_support_provider_reg_query.yml index 967b7ea5c0..5efe828ec5 100644 --- a/detections/endpoint/windows_security_support_provider_reg_query.yml +++ b/detections/endpoint/windows_security_support_provider_reg_query.yml @@ -32,6 +32,7 @@ tags: analytic_story: - Windows Post-Exploitation - Prestige Ransomware + - Sneaky Active Directory Persistence Tricks asset_type: Endpoint cis20: - CIS 3 diff --git a/stories/sneaky_active_directory_persistence_tricks.yml b/stories/sneaky_active_directory_persistence_tricks.yml index 9127767a66..3b579b4f9a 100644 --- a/stories/sneaky_active_directory_persistence_tricks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -13,7 +13,7 @@ narrative: Persistence consists of techniques that adversaries use to keep acces a short period of time. At the time of writing, 8 years after the initial blog post, most of these techniques are still possible since they abuse legitimate administrative functionality and not software vulnerabilities. Security engineers defending Active Directory networks should be aware of these technique available to adversaries post exploitation and deploy both preventive and detective security controls for them.\ - This analytic story groups detection opportunities for most of the techniques described on Seans blog post as well as other high impact attacks against Active Directory networks and Domain Controllers. + This analytic story groups detection opportunities for most of the techniques described on Seans blog post as well as other high impact attacks against Active Directory networks and Domain Controllers like DCSync and DCShadow. For some of these detection opportunities, it is necessary to enable the necessary GPOs and SACLs required, otherwise the event codes will not trigger. Each detection includes a list of requirements for enabling logging. references: - https://adsecurity.org/?p=1929 From 2bec2c838465b60f4a4e25b5ae63e76318695bb4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 15 Feb 2023 15:38:28 -0500 Subject: [PATCH 75/90] tagging an extra detection --- ...ws_group_policy_features_through_registry.yml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml index 46d579f45e..e3ab45ab81 100644 --- a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml +++ b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml @@ -1,18 +1,14 @@ name: Windows Disable Windows Group Policy Features Through Registry id: 63a449ae-9f04-11ec-945e-acde48001122 -version: 2 +version: 3 date: '2022-11-14' author: Steven Dick, Teoderick Contreras, Splunk type: Anomaly datamodel: - Endpoint -description: This analytic is to detect a suspicious registry modification to disable - windows features. These techniques are seen in several ransomware malware to impair - the compromised host to make it hard for analyst to mitigate or response from the - attack. Disabling these known features make the analysis and forensic response more - hard. Disabling these feature is not so common but can still be implemented by the - administrator for security purposes. In this scenario filters for users that are - allowed doing this is needed. +description: The following analytic detects a suspicious registry modification used to disable + windows features. This technique has been identified in several ransomware malware families to impair + the compromised host and make it harder for analysts to mitigate or respond to an attack. search: '| tstats `security_content_summariesonly` count min(_time) AS firstTime max(_time) AS lastTime FROM datamodel=Endpoint.Processes BY _time span=1h Processes.user Processes.process_id Processes.process_name Processes.process Processes.process_path Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` | join process_guid [ @@ -27,7 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the offical Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: unknown +known_false_positives: Disabling these features for legitimate purposes is not a common use case but can still be implemented by the + administrators. Filter as needed. references: - https://hybrid-analysis.com/sample/ef1c427394c205580576d18ba68d5911089c7da0386f19d1ca126929d3e671ab?environmentId=120&lang=en - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Krotten-N/detailed-analysis @@ -37,6 +34,7 @@ tags: - Ransomware - Windows Defense Evasion Tactics - Windows Registry Abuse + - Sneaky Active Directory Persistence Tricks dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/ransomware_disable_reg/sysmon.log kill_chain_phases: From 9c14295a6b26743823e9611469f5db6f4a4f4e57 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Feb 2023 12:01:18 -0500 Subject: [PATCH 76/90] Update windows_ad_same_domain_sid_history_addition.yml --- .../endpoint/windows_ad_same_domain_sid_history_addition.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml index 8f2ed5bf6a..5f33a7ff26 100644 --- a/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_same_domain_sid_history_addition.yml @@ -20,7 +20,7 @@ search: '`wineventlog_security` (EventCode=4742 OR EventCode=4738) NOT SidHistor how_to_implement: To successfully implement this search, you need to be ingesting eventcodes `4738` and `4742`. The Advanced Security Audit policy settings `Audit User Account Management` and `Audit Computer Account Management` - within `Account Management` all need to be enabled. SID resolution is not required. + within `Account Management` all need to be enabled. SID resolution is not required.. known_false_positives: Unknown references: - https://adsecurity.org/?p=1772 From 55850fe25e5ec1e69754b8d54c2f2873269e6730 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Feb 2023 13:28:41 -0500 Subject: [PATCH 77/90] adding custom app --- bin/docker_detection_tester/modules/validate_args.py | 5 +++++ bin/docker_detection_tester/test_config_github_actions.json | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index fd02b34df5..8469b76231 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -163,6 +163,11 @@ setup_schema = { "app_number": 2734, "app_version": "1.9.2", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz" + }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": 9999, + "app_version": "1.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5e6ba7915d..49a7687ab0 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -65,6 +65,11 @@ "app_version": "8.1.0", "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_810.tgz" }, + "SPLUNK_TA_FIX_WINDOWS":{ + "app_number": 9999, + "app_version": "1.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/Splunk_TA_fix_windows.tgz" + }, "SPLUNK_COMMON_INFORMATION_MODEL": { "app_number": 1621, "app_version": "5.0.1", From 8e13530a0645e2888975fd0d4b468ce678996e99 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Feb 2023 14:03:20 -0500 Subject: [PATCH 78/90] fixing file name --- ...ws_ad_replication_request_initiated_by_user_account.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index 4df3a000c4..852ee71aaa 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,7 +1,7 @@ name: Windows AD Replication Request Initiated by User Account Test tests: - name: Windows AD Replication Request Initiated by User Account - file: endpoint/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml + file: endpoint/endpoint/windows_ad_replication_request_initiated_by_user_account.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 70790ac1c8c03b04e496509a9d14492669268128 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 22 Feb 2023 14:34:10 -0500 Subject: [PATCH 79/90] fixing test file path --- ..._ad_replication_request_initiated_by_user_account.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index 852ee71aaa..d9c577236c 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,7 +1,7 @@ name: Windows AD Replication Request Initiated by User Account Test tests: - name: Windows AD Replication Request Initiated by User Account - file: endpoint/endpoint/windows_ad_replication_request_initiated_by_user_account.yml + file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now @@ -10,4 +10,4 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log source: XmlWinEventLog:Security sourcetype: xmlwineventlog - update_timestamp: true + update_timestamp: true \ No newline at end of file From 15150886c9925a88638113b8524841631bd6c578 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 24 Feb 2023 12:24:55 -0700 Subject: [PATCH 80/90] fixes --- ...ateral_movement_commandline_parameters.yml | 13 ++-- ...notepad_with_no_command_line_arguments.yml | 73 ++++++++++++++++++ ...mimikatz_crypto_export_file_extensions.yml | 2 +- ...windows_process_injection_into_notepad.yml | 75 +++++++++++++++++++ ...x_sliver_adversary_emulation_framework.yml | 23 ++++++ ...ad_with_no_command_line_arguments.test.yml | 13 ++++ ...ws_process_injection_into_notepad.test.yml | 13 ++++ 7 files changed, 204 insertions(+), 8 deletions(-) create mode 100644 detections/endpoint/notepad_with_no_command_line_arguments.yml create mode 100644 detections/endpoint/windows_process_injection_into_notepad.yml create mode 100644 stories/bishopfox_sliver_adversary_emulation_framework.yml create mode 100644 tests/endpoint/notepad_with_no_command_line_arguments.test.yml create mode 100644 tests/endpoint/windows_process_injection_into_notepad.test.yml diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index dfdb55894e..cbe547f715 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -1,7 +1,7 @@ name: Impacket Lateral Movement Commandline Parameters id: 8ce07472-496f-11ec-ab3b-3e22fbd008af -version: 2 -date: '2022-01-18' +version: 3 +date: '2023-02-24' author: Mauricio Velazco, Splunk type: TTP datamodel: @@ -14,11 +14,10 @@ description: This analytic looks for the presence of suspicious commandline para scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*" - OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe (Processes.process = "*/Q /c * \\\\127.0.0.1\\*$*" AND Processes.process IN ("*2>&1*","*2>&1*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `impacket_lateral_movement_commandline_parameters_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml new file mode 100644 index 0000000000..0aaa079b83 --- /dev/null +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -0,0 +1,73 @@ +name: Notepad with no Command Line Arguments +id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179 +version: 1 +date: '2023-02-22' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | regex process="(?i)(notepad\.exe.{0,4}$)" + | `notepad_with_no_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. +known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior. +references: +- REFERENCE +tags: + analytic_story: + - BishopFox Sliver Adversary Emulation Framework + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log + impact: 50 + kill_chain_phases: + - Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ with no command line arguments. + mitre_attack_id: + - T1055 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 35 + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml index 7ddcaa92a2..dd85b2f0b0 100644 --- a/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml +++ b/detections/endpoint/windows_mimikatz_crypto_export_file_extensions.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: Anomaly datamodel: - Endpoint -description: The following analytic identifies hardcoded extensions related to the Crypo module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported. +description: The following analytic identifies hardcoded extensions related to the Crypto module within Mimikatz. Moving certificates or downloading them is not malicious, however with Mimikatz having hardcoded names it helps to identify potential usage of certificates being exported. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.keyx.rsa.pvk","*sign.rsa.pvk","*sign.dsa.pvk","*dsa.ec.p8k","*dh.ec.p8k", "*.pfx", "*.der") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `windows_mimikatz_crypto_export_file_extensions_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml new file mode 100644 index 0000000000..e53c0c99a2 --- /dev/null +++ b/detections/endpoint/windows_process_injection_into_notepad.yml @@ -0,0 +1,75 @@ +name: Windows Process Injection into Notepad +id: b8340d0f-ba48-4391-bea7-9e793c5aae36 +version: 1 +date: '2023-02-22' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. + By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. + This particular behavior will occur from a source image that is the initial payload dropped. +search: '`sysmon` EventCode=10 TargetImage IN (*\\notepad.exe) NOT (SourceImage IN ("*\\system32\\*","*\\syswow64\\*","*\\Program Files\\*")) GrantedAccess IN ("0x40","0x1fffff") | stats count min(_time) as firstTime max(_time) as lastTime by dest SourceImage TargetImage GrantedAccess CallTrace + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_process_injection_into_notepad_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives may be present based on SourceImage paths. If removing the paths is important, realize svchost and many native binaries inject into notepad consistently. Restrict or tune as needed. +references: +- https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/ +- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors +tags: + analytic_story: + - BishopFox Sliver Adversary Emulation Framework + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log + impact: 40 + kill_chain_phases: + - Exploitation + message: An instance of $SourceImage$ injecting into $TargetImage$ was identified on endpoint $dest$. + mitre_attack_id: + - T1055 + - T1055.002 + nist: + - DE.CM + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: SourceImage + type: Process + role: + - Parent Process + - name: TargetImage + type: Process + role: + - Child Process + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - SourceImage + - TargetImage + - GrantedAccess + - CallTrace + risk_score: 32 + security_domain: endpoint \ No newline at end of file diff --git a/stories/bishopfox_sliver_adversary_emulation_framework.yml b/stories/bishopfox_sliver_adversary_emulation_framework.yml new file mode 100644 index 0000000000..a8531255aa --- /dev/null +++ b/stories/bishopfox_sliver_adversary_emulation_framework.yml @@ -0,0 +1,23 @@ +name: BishopFox Sliver Adversary Emulation Framework +id: 8c2e2cba-3fd8-424f-a890-5080bdaf3f31 +version: 1 +date: '2023-01-24' +author: Michael Haag, Splunk +description: The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023). +narrative: Sliver is an open source cross-platform adversary emulation/red team framework produced by BishopFox. +references: + - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors + - https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf + - https://www.proofpoint.com/uk/blog/security-briefs/ta551-uses-sliver-red-team-tool-new-activity + - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control + - https://github.com/sliverarmory/armory + - https://github.com/BishopFox/sliver +tags: + analytic_story: BishopFox Sliver Adversary Emulation Framework + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/endpoint/notepad_with_no_command_line_arguments.test.yml b/tests/endpoint/notepad_with_no_command_line_arguments.test.yml new file mode 100644 index 0000000000..95a87b12b0 --- /dev/null +++ b/tests/endpoint/notepad_with_no_command_line_arguments.test.yml @@ -0,0 +1,13 @@ +name: Notepad with no Command Line Arguments Unit Test +tests: +- name: Notepad with no Command Line Arguments + file: endpoint/notepad_with_no_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: notepad_windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/notepad_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_process_injection_into_notepad.test.yml b/tests/endpoint/windows_process_injection_into_notepad.test.yml new file mode 100644 index 0000000000..acba7a6722 --- /dev/null +++ b/tests/endpoint/windows_process_injection_into_notepad.test.yml @@ -0,0 +1,13 @@ +name: Windows Process Injection into Notepad Unit Test +tests: +- name: Windows Process Injection into Notepad + file: endpoint/windows_process_injection_into_notepad.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: T1055_windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/T1055_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 631c9d4cf05b0a6d7939217361b3b99a8b40204f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Wed, 1 Mar 2023 09:16:22 -0700 Subject: [PATCH 81/90] XML driver load Updated to XML logs --- .../windows_driver_load_non_standard_path.yml | 13 +++++++------ .../windows_driver_load_non_standard_path.test.yml | 8 ++++---- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 066c0483a5..4f7c25018b 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -1,15 +1,15 @@ name: Windows Driver Load Non-Standard Path id: 9216ef3d-066a-4958-8f27-c84589465e62 -version: 1 -date: '2022-04-04' +version: 2 +date: '2023-02-24' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint -description: The following analytic uses Windows EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path. +description: The following analytic uses Windows XML EventCode 7045 to identify new Kernel Mode Drivers being loaded in Windows from a non-standard path. Note that, adversaries may move malicious or vulnerable drivers into these paths and load up. The idea is that this analytic provides visibility into drivers loading in non-standard file paths. -search: '`wineventlog_system` EventCode=7045 Service_Type="kernel mode driver" NOT (Service_File_Name IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) - | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Service_File_Name Service_Name Service_Start_Type Service_Type +search: '`wineventlog_system` EventCode=7045 ServiceType="kernel mode driver" NOT (ImagePath IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_driver_load_non_standard_path_filter`' @@ -34,13 +34,14 @@ tags: - Source:Endpoint - Stage:Persistence dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log impact: 60 kill_chain_phases: - Installation message: A kernel mode driver was loaded from a non-standard path on $ComputerName$. mitre_attack_id: - T1014 + - T1068 nist: - DE.CM observable: diff --git a/tests/endpoint/windows_driver_load_non_standard_path.test.yml b/tests/endpoint/windows_driver_load_non_standard_path.test.yml index cc7095689b..4fec7cc049 100644 --- a/tests/endpoint/windows_driver_load_non_standard_path.test.yml +++ b/tests/endpoint/windows_driver_load_non_standard_path.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: 7045_kerneldrivers.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/7045_kerneldrivers.log - source: WinEventLog:System - sourcetype: WinEventLog + - file_name: xml7045_windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/drivers/xml7045_windows-system.log + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog update_timestamp: true \ No newline at end of file From cef780f011e412bd5bae35dd3d17d87b173bfd73 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 2 Mar 2023 07:08:40 -0700 Subject: [PATCH 82/90] Update suspicious_regsvr32_register_suspicious_path.yml --- ...ious_regsvr32_register_suspicious_path.yml | 59 ++++++++++++++----- 1 file changed, 45 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 7c32281b0d..1da6809953 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,20 +1,18 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: 2 -date: '2021-01-28' +version: 3 +date: '2023-03-02' author: Michael Haag, Splunk type: TTP datamodel: - Endpoint description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code - by using non-standard file extensions to load malciious DLLs. Upon investigating, + by using non-standard file extensions to load DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review additional parrallel processes and child processes for additional activity. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata* - OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll - Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user - Processes.parent_process Processes.process_name Processes.process Processes.original_file_name + as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process IN ("*\\appdata\\*", "*\\programdata\\*","*\\windows\\temp\\*") NOT (Processes.process IN ("*.dll*", "*.ax*", "*.ocx*")) + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`' how_to_implement: You must be ingesting endpoint data that tracks process activity, @@ -54,22 +52,29 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: Suspicious $Processes.process_path.file_path$ process potentially loading - malicious code + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to evade detection by using a non-standard file extension. mitre_attack_id: - T1218 - T1218.010 nist: - DE.CM observable: - - name: dest - type: Endpoint + - name: user + type: User role: - Victim - - name: Processes.process_path.file_path - type: File Name + - name: dest + type: Hostname role: - - Attacker + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -91,3 +96,29 @@ tags: security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon + + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of parent_process_name$ spawning process_name$ was identified on endpoint Computer$ by user user$ attempting to decode a file. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file From 1099e16cf88d6dd827903f68f03da7946b2c6b19 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 2 Mar 2023 07:13:02 -0700 Subject: [PATCH 83/90] Update suspicious_regsvr32_register_suspicious_path.yml --- ...ious_regsvr32_register_suspicious_path.yml | 28 +------------------ 1 file changed, 1 insertion(+), 27 deletions(-) diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 1da6809953..9468a3bdb9 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -95,30 +95,4 @@ tags: risk_score: 35 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon - - impact: 80 - confidence: 100 - # (impact * confidence)/100 - risk_score: 80 - context: - - Source:Endpoint - - Stage:Defense Evasion - message: An instance of parent_process_name$ spawning process_name$ was identified on endpoint Computer$ by user user$ attempting to decode a file. - observable: - - name: user - type: User - role: - - Victim - - name: Computer - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process \ No newline at end of file + - Splunk_TA_microsoft_sysmon \ No newline at end of file From 38fc323b98bd7bb57f5e4d31d3fdcb6d8e03b151 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 2 Mar 2023 08:19:01 -0700 Subject: [PATCH 84/90] Update suspicious_rundll32_dllregisterserver.yml --- .../suspicious_rundll32_dllregisterserver.yml | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index c8be5358d0..ceace0ff05 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -52,7 +52,7 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: $Processes.process_path.file_path$ process potentially loading malicious + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a DLL. code mitre_attack_id: - T1218 @@ -61,14 +61,22 @@ tags: - PR.PT - DE.CM observable: - - name: dest - type: Endpoint + - name: user + type: User role: - Victim - - name: Processes.process_path.file_path - type: File Name + - name: dest + type: Hostname role: - - Attacker + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -89,4 +97,4 @@ tags: risk_score: 35 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_microsoft_sysmon \ No newline at end of file From cdd7de9ad483d425f131ac93f847483aeb0a204a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 2 Mar 2023 08:21:07 -0700 Subject: [PATCH 85/90] Update suspicious_rundll32_dllregisterserver.yml --- detections/endpoint/suspicious_rundll32_dllregisterserver.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index ceace0ff05..38bc57429d 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -70,7 +70,7 @@ tags: role: - Victim - name: parent_process_name - type: Parent Process + type: Process role: - Parent Process - name: process_name From c08564d2d714883cad0247a895cc4ff3f332aeae Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 2 Mar 2023 08:24:32 -0700 Subject: [PATCH 86/90] Update suspicious_reg_exe_process.yml --- .../endpoint/suspicious_reg_exe_process.yml | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index aea9e3c110..1e9826eb13 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -47,21 +47,28 @@ tags: impact: 70 kill_chain_phases: - Actions on Objectives - message: Suspicious $Processes.process_path.file_path$ process running with an uncommon - parent process $Processes.parent_process_name$ + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a registry entry. mitre_attack_id: - T1112 nist: - DE.CM observable: - - name: dest - type: Endpoint + - name: user + type: User role: - Victim - - name: Processes.process_path.file_path - type: File Name + - name: dest + type: Hostname role: - - Attacker + - Victim + - name: parent_process_name + type: Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process product: - Splunk Enterprise - Splunk Enterprise Security @@ -78,4 +85,4 @@ tags: risk_score: 35 security_domain: endpoint supported_tas: - - Splunk_TA_microsoft_sysmon + - Splunk_TA_microsoft_sysmon \ No newline at end of file From f239a658b38296c8c5edfd1f16790705e623e52a Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Mar 2023 05:59:36 -0700 Subject: [PATCH 87/90] Sliver --- ...notepad_with_no_command_line_arguments.yml | 4 +- .../windows_driver_load_non_standard_path.yml | 10 ++-- .../windows_service_create_sliverc2.yml | 56 +++++++++++++++++++ .../windows_service_create_sliverc2.test.yml | 13 +++++ 4 files changed, 77 insertions(+), 6 deletions(-) create mode 100644 detections/endpoint/windows_service_create_sliverc2.yml create mode 100644 tests/endpoint/windows_service_create_sliverc2.test.yml diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml index 0aaa079b83..fff9217112 100644 --- a/detections/endpoint/notepad_with_no_command_line_arguments.yml +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -7,6 +7,7 @@ type: TTP datamodel: - Endpoint description: The following analytic identifies behavior related to default SliverC2 framework where it will inject into Notepad.exe and spawn Notepad.exe with no command line arguments. In testing, this is a common procedure for SliverC2 usage, however may be modified or changed. + From Microsoft, "The Sideload, SpawnDll, and Execute-Assembly commands spawn and inject into notepad.exe by default. The following query finds process creation events where the same process creates and injects into notepad.exe within 10 seconds." search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=notepad.exe AND Processes.action!="blocked" by host _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.parent_process | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -16,7 +17,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: False positives may be present and filtering may need to occur based on organization endpoint behavior. references: -- REFERENCE +- https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ +- https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors#Purple-Team-Section tags: analytic_story: - BishopFox Sliver Adversary Emulation Framework diff --git a/detections/endpoint/windows_driver_load_non_standard_path.yml b/detections/endpoint/windows_driver_load_non_standard_path.yml index 4f7c25018b..7d8bdb9b97 100644 --- a/detections/endpoint/windows_driver_load_non_standard_path.yml +++ b/detections/endpoint/windows_driver_load_non_standard_path.yml @@ -54,11 +54,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - ComputerName + - _time + - Computer - EventCode - - Service_File_Name - - Service_Name - - Service_Start_Type - - Service_Type + - ImagePath + - ServiceName + - ServiceType risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml new file mode 100644 index 0000000000..14471645ee --- /dev/null +++ b/detections/endpoint/windows_service_create_sliverc2.yml @@ -0,0 +1,56 @@ +name: Windows Service Create SliverC2 +id: 89dad3ee-57ec-43dc-9044-131c4edd663f +version: 1 +date: '2023-03-03' +author: Michael Haag, Splunk +type: TTP +datamodel: +- Endpoint +description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2. + We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference). +search: '`wineventlog_system` EventCode=7045 ServiceName="sliver" + | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ImagePath ServiceName ServiceType + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_create_sliverc2_filter`' +how_to_implement: To implement this analytic, the Windows EventCode 7045 will need to be logged from the System Event log. The Windows TA for Splunk is also recommended. +known_false_positives: False positives should be limited, but if another service out there is named Sliver, filtering may be needed. +references: + - https://github.com/BishopFox/sliver/blob/71f94928bf36c1557ea5fbeffa161b71116f56b2/client/command/exec/psexec.go#LL61C5-L61C16 + - https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ + - https://regex101.com/r/DWkkXm/1 +tags: + analytic_story: + - BishopFox Sliver Adversary Emulation Framework + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 100 + context: + - Source:Endpoint + - Stage:Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log + impact: 90 + kill_chain_phases: + - Installation + message: A user mode service was created on $ComputerName$ related to SliverC2. + mitre_attack_id: + - T1569 + - T1569.002 + nist: + - DE.CM + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: 90 + security_domain: endpoint \ No newline at end of file diff --git a/tests/endpoint/windows_service_create_sliverc2.test.yml b/tests/endpoint/windows_service_create_sliverc2.test.yml new file mode 100644 index 0000000000..7b7df9cdeb --- /dev/null +++ b/tests/endpoint/windows_service_create_sliverc2.test.yml @@ -0,0 +1,13 @@ +name: Windows Service Create SliverC2 Unit Test +tests: +- name: Windows Service Create SliverC2 + file: endpoint/windows_service_create_sliverc2.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sliver_windows-system.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log + source: WinEventLog:System + sourcetype: WinEventLog + update_timestamp: true From cea7d34435767c36fdfcb37004617ef96bbfdccd Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 3 Mar 2023 14:38:03 -0700 Subject: [PATCH 88/90] not datamodel --- detections/endpoint/windows_process_injection_into_notepad.yml | 3 +-- detections/endpoint/windows_service_create_sliverc2.yml | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_process_injection_into_notepad.yml b/detections/endpoint/windows_process_injection_into_notepad.yml index e53c0c99a2..88e8c3f10e 100644 --- a/detections/endpoint/windows_process_injection_into_notepad.yml +++ b/detections/endpoint/windows_process_injection_into_notepad.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-02-22' author: Michael Haag, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytic utilizes Sysmon to identify process injection into Notepad.exe, based on GrantedAccess requests - 0x40 and 0x1fffff. This particular behavior is attributed to the defaults of the SliverC2 framework by BishopFox. By default, the analytic filters out any SourceImage paths of System32, Syswow64 and program files. Add more as needed, or remove and monitor what is consistently injecting into notepad.exe. This particular behavior will occur from a source image that is the initial payload dropped. diff --git a/detections/endpoint/windows_service_create_sliverc2.yml b/detections/endpoint/windows_service_create_sliverc2.yml index 14471645ee..eaf0689cea 100644 --- a/detections/endpoint/windows_service_create_sliverc2.yml +++ b/detections/endpoint/windows_service_create_sliverc2.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-03-03' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: When an adversary utilizes SliverC2 to laterally move with the Psexec module, it will create a service with the name and description of "Sliver" and "Sliver Implant". Note that these may be easily changed and are specific to only SliverC2. We have also created the same regex as Microsoft has outlined to attempt to capture the suspicious service path (regex101 reference). search: '`wineventlog_system` EventCode=7045 ServiceName="sliver" From 145881799d17d08cdd3ee908ebf37c2a7009626e Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Mar 2023 17:33:42 -0500 Subject: [PATCH 89/90] fixing name --- ...indows_ad_privileged_account_sid_history_addition.yml} | 2 +- ...s_ad_privileged_account_sid_history_addition.test.yml} | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) rename detections/experimental/endpoint/{windows_active_directory_privileged_account_sid_history_addition.yml => windows_ad_privileged_account_sid_history_addition.yml} (97%) rename tests/experimental/endpoint/{windows_active_directory_privileged_account_sid_history_addition.test.yml => windows_ad_privileged_account_sid_history_addition.test.yml} (64%) diff --git a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml b/detections/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.yml similarity index 97% rename from detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml rename to detections/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.yml index 45fe77440e..1b3c5a3f25 100644 --- a/detections/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.yml +++ b/detections/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.yml @@ -1,4 +1,4 @@ -name: Windows Active Directory Privileged Account SID History Addition +name: Windows AD Privileged Account SID History Addition id: 6b521149-b91c-43aa-ba97-c2cac59ec830 version: 1 date: '2022-09-12' diff --git a/tests/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.test.yml b/tests/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.test.yml similarity index 64% rename from tests/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.test.yml rename to tests/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.test.yml index ea0c7e4b01..c03cc61e4b 100644 --- a/tests/experimental/endpoint/windows_active_directory_privileged_account_sid_history_addition.test.yml +++ b/tests/experimental/endpoint/windows_ad_privileged_account_sid_history_addition.test.yml @@ -1,7 +1,7 @@ -name: Active Directory SID History Privileged Account Addition Unit Test +name: Windows AD Privileged Account SID History Addition Unit Test tests: -- name: Active Directory SID History Privileged Account Addition - file: experimental/active_directory_sid_history_privileged_account_addition.yml +- name: Windows AD Privileged Account SID History Addition + file: experimental/windows_ad_privileged_account_sid_history_addition.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now @@ -11,3 +11,5 @@ tests: source: XmlWinEventLog:Security sourcetype: xmlwineventlog update_timestamp: true + + From 5728a3f9d0def4108c4200895157a53aa067546e Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 6 Mar 2023 04:55:36 -0700 Subject: [PATCH 90/90] Update windows_service_create_sliverc2.test.yml --- tests/endpoint/windows_service_create_sliverc2.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_service_create_sliverc2.test.yml b/tests/endpoint/windows_service_create_sliverc2.test.yml index 7b7df9cdeb..fae6b890ec 100644 --- a/tests/endpoint/windows_service_create_sliverc2.test.yml +++ b/tests/endpoint/windows_service_create_sliverc2.test.yml @@ -8,6 +8,6 @@ tests: attack_data: - file_name: sliver_windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog + source: XmlWinEventLog:System + sourcetype: XmlWinEventLog update_timestamp: true