From fcfea82cd4d9bd7ccdd7beac2c0c3fb114df502f Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 14 May 2020 11:30:28 +0200 Subject: [PATCH] make small changes --- ...owershell_execution_policy_to_unrestricted_or_bypass.yml | 2 +- .../detect_credential_dumping_through_LSASS_access.yml | 2 +- response_tasks/investigate_pass_the_ticket_attempts.yml | 6 ++---- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 96e9e04f15..20db8405eb 100644 --- a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -17,7 +17,7 @@ search: "| tstats `security_content_summariesonly` count min(_time) as firstTime \ (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass)\ \ by Registry.registry_path Registry.registry_key_name Registry.registry_value_name\ \ Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|\ - \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`\_" + \ `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` " known_false_positives: Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should diff --git a/detections/detect_credential_dumping_through_LSASS_access.yml b/detections/detect_credential_dumping_through_LSASS_access.yml index 42f7ba29a1..bcff7da23a 100644 --- a/detections/detect_credential_dumping_through_LSASS_access.yml +++ b/detections/detect_credential_dumping_through_LSASS_access.yml @@ -17,7 +17,7 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR G | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `detect_credential_dumping_through_LSAS`detect_credential_dumping_through_lsass_access_filter` ' + | `detect_credential_dumping_through_lsass_access_filter` ' known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need diff --git a/response_tasks/investigate_pass_the_ticket_attempts.yml b/response_tasks/investigate_pass_the_ticket_attempts.yml index 7ca5f470c9..e6de16dd57 100644 --- a/response_tasks/investigate_pass_the_ticket_attempts.yml +++ b/response_tasks/investigate_pass_the_ticket_attempts.yml @@ -12,10 +12,8 @@ how_to_implement: To successfully implement this search you need to be ingesting author: Patrick Bareiss, Splunk inputs: - dest -search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user - "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) - AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 - | rename new_user AS user' +search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | stats count BY user, dest, EventCode | stats max(count) + AS max_count sum(count) AS sum_count BY user, dest | where sum_count/max_count!=2' tags: analytics_story: - Credential Dumping